last executing test programs: 13.685819549s ago: executing program 3 (id=832): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x100, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x0, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x100000, 0x0, [0xd1b, 0x7, 0xffffffff, 0xffffff0000000000, 0x573, 0x0, 0x200, 0x8]}) syz_usb_connect(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0xfa, 0x8a, 0x7d, 0x8, 0x1199, 0xc081, 0x7ce1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x7f, 0x3, 0x0, 0x0, [{{0x9, 0x4, 0x8, 0xf9, 0x2, 0xb3, 0xaa, 0x6b, 0xe6, [], [{{0x9, 0x5, 0xc, 0x12, 0x40, 0xe, 0xd, 0x3}}, {{0x9, 0x5, 0x6, 0x1, 0x40, 0x8, 0x4, 0x1}}]}}]}}]}}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) 11.897039655s ago: executing program 3 (id=847): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) semget$private(0x0, 0x6, 0x3b1) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xfffffffe, 0x0, 0xd, 0x400009, 0x8, 0xa}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000b640)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000240)="1c8b8753c92bc4d09ca098bed056bbb670d43c6f8443b71e59a53f327f5942ad30aa90", 0x23}, {&(0x7f00000002c0)="87a2978462ecec58035ccd5b38ec0518dd0c53495154fb334c4516d2a8efdc30d4ff", 0x22}, {&(0x7f00000004c0)="daf3004b9f61d415fab14abc3f862cecba094592c8209803984f6cb408ae4cc8a3150b9fe4bcacb0000d5ce7dc8c10683314c972452e02dc03b2bb9991f24dc24b9100", 0x43}, {&(0x7f0000000540)="42fb9e4d0042b3473c5f0982ffe1bf6cbca7ab186013e7666259159ee5acbf294ceb27b2ddc964866da7b893f120384c5c568129dc2017864c6cbcde6c73e76b2304294c4017085569159b67ffc1ce821403d67b88e4111fb5d97273ada44893cc82", 0x62}, {&(0x7f00000003c0)="18a4041483ee1b822fcb2ab546d32e0c86bd6a1106b6f4f3eaccb21025d2b2981f9b09e6f10714569e", 0x29}, {&(0x7f00000005c0)="4d6d172ebfe1e9a70190afb12af797428b053f64", 0x14}, {&(0x7f0000000600)="cee9e85060f653c5121679b7b87175e776e2047fbe8399902b5699f12a01f5b51b751dc6cc8f79e169208e2d5b4faa3940bd3a827dca5a9abc841253a14b9a839b533f3e853616c88d82c8da50e03ab4d3db1dff56b10a456ff9f0cc267989aa1903a0d99f4037748a31bfb0b9ed93ca92d9fa121387b0952b7c2b3cb4", 0x7d}], 0x7, &(0x7f0000000780)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee00}}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}, @cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r1, 0xffffffffffffffff, r2, r1, r2]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x10}}], 0x140}}, {{&(0x7f0000000f80)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000007040)=[{&(0x7f0000006fc0)="51423d22162be206380796b09e1a9357de9e39055fc7f361688d5cf7b45c7caed4260d726c9d02d086569f92b54e07c1c8b95c70b382b53cd39546e347ca13318fbd0b22f1726ea5e595275ca5a3652a18aa9b80afa2f4b7a1424638bb98e7ff7a54", 0x62}, {&(0x7f0000001000)="bf508f309d050bc2d285449a3131b5c7a940e04cd5059305ce", 0x19}], 0x2, &(0x7f0000007140)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0xee01}}}], 0x20, 0x80}}, {{&(0x7f0000007180)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000380)=[{&(0x7f00000008c0)="e0deeff466f55cc90b324932864a96f20060555dac985d2eb7162c661c142f37d6194f9dd330b5061d7a2f9518a150ec890d362ce54992695665e14d7f078b5d669616a2bfeb5792c2c58e8888b936320d52a9fecd3736cc18753de5fc8ee356a67a055baff40a879733594c779d6e820b794ae67d31c7ae396acd15930ee110cb791748ec71018104bb92dc2002548b42847c259fc2519660305f54efc03a841093b0db61b1d6e846e14f3ddfe1fc8fa487d428f09e3838548831f15a80f99bf4f08bd1b1cadfc24ee48b6b6d421a1145727f23bc3ae659b6114dcc09b46c80cfda4c89887aac", 0xe7}], 0x1, &(0x7f00000075c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [r2, r1, r1, r1, r1, r0]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [r1, r2, r1, r2]}}], 0x110, 0x40004}}, {{&(0x7f0000007700)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000007b80)=[{&(0x7f0000007780)="d40fcd59e1a4a334dd103b6ef4631167ffb7e861b3dc24747ba71c447e2947202e6c18e46601c59bceb737e09b79c39586ec2421da3ec2e342c20193f2502837d6fece98eb84dc5b7578d29e56d27dbac3e34f29be270d4850f707b259301553e358753fe71cd037f723895f1a262681ba70cde5253f324c830671f6171830ee4c149a75629923079f7e51fcf9c6d8946edf92dcd5dc0dbbec27c8c698501e87bd", 0xa1}, {&(0x7f0000007840)}, {&(0x7f0000007880)="790da8b6f70d30a43505a5bdda85ff989dd6d9a721ec90aff4169f0123bfb9274fed122eb004c644dffb4befb76e9e2386eaed68a9dedaef1923051be5", 0x3d}, {&(0x7f00000078c0)="01ecdf1cb325ed32f07e3a9fd4bafdebd12c9b98ccc73efc40d2c06519fe5dba7a418f7dbff2e1b12582d7dc2f64570a7bb92eddfe7a4b4ed4cbd26d", 0x3c}, {&(0x7f0000007900)="dfdfec27", 0x4}, {&(0x7f0000007940)="94fbaee8b12df10b1927890a2bc75dda59f1400eaa8a7d9ae6b1d4ff82f3ef7585c52a", 0x23}, {&(0x7f0000007980)="ef5476739cdaa4734c3cae105f38ead1f7a5d66a812e3e05d5b1e5d6cab7c3b73061e9de06312afc7f7c87aed29986633bbc977bc34682b4e58f76734af75014fd800876ed5b69530e5fb0d97cafafe70f7bdf4cbe4634907b8214279a251c19c51a6121e1d6ed0a11462c9c2a9c36593928cca51ca340a9a1b132fe509501c4276c3e622e5df5e4ab5cbdd5de95ae25961a8cc80d6229ed1a0ccafe7726597b10af068004404859b118a5dddbdcecd17e435e6f2bfdd3bb1eac81f0e63b6eab26a43ef10e06c9be", 0xc8}, {&(0x7f0000007a80)="014f168a4a68fb368d46ad2abb7935ea80c91cab22801611783185f6a17adc7f60ccf789863cbf64fbcb2c3f08d899494e545276a94165fb9a8ef974fd9a0cb904ef7237d7350738dd756176722a841c4a8a22cd70bd1bc7b0a9441280c7d644d827f3ef99b6fffad563e38d", 0x6c}, {&(0x7f0000007b00)="1bde814f5449478be556a2d18ed3abed41d0a4604a336c73bfef93be93607798bfcb00a2316a58dd60058bf192b897ec792b40cb13692d608fc3ba05de8c89624326620330a538cc04a182295e2cd06a78ca", 0x52}], 0x9, &(0x7f0000009e80)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, r2, 0xffffffffffffffff, r1, r2, 0xffffffffffffffff, 0xffffffffffffffff, r2]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, r2, 0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r2]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r1, r1, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xd8, 0x4000}}, {{&(0x7f0000009f80)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f000000b540)=[{&(0x7f000000a000)="46f63b9b9281bfb02f12aba73ee0f48f88cc0294d3c91c06038546df144bbf36cedf6a2ef65d166f3c7666c43bcc3a8301c1405c09f314a47fc9568307376745960e22125694aed43e3b469f819c5faecfbfff6603b95f7bd32ed0ce1743dcf43ccc6ad7b984c178e751b5655c3125808ac1099386883da12f76abfe682289dc25ad9de1da3b203b82458e7847ac2e5844e8f5f1574eec6a3978185a8f", 0x9d}, {&(0x7f000000a0c0)="cb42c6de00c497556f99d54a0b0f61c23e379292e1594f5e9f2fa76c62e088", 0x1f}, {&(0x7f000000a100)="9631a5a00d98c1214a5b547a3a9381b5fb7f0e77c9a7d8bf80ac17bb72b5d0c00814babdd046f840ff536271", 0x2c}, {&(0x7f000000a140)="d50f701925c1834f762586ff52f7ea5f90c46639c7ee01698a7b3c968d1e1c1102e0ca3a64aecfc79931e9410e178f86596ebded02fdbf7719", 0x39}, {&(0x7f000000a180)="a79f3ce59c082529439b63667439717a71dbacd05aa3b0d659bb4d1275b6cb56abf41b4eecde992c5d4e46381684e6dc5c498b65b4fd50a34d832342528697f6ce4b3005ceddb30288f679bc1077dcfa6016e75a6f9860460fbbc3924d332d996c8788aa357630fb0e9d06d55abb306ec8c280faf635326d97c231ce15df16f84745b1d34e16c74faaa8b5479a6b441cb722fc3a651848953b70889211b88057544ef68c40a8247be6aefac49d189dfb59e6129f50dc42fa3507d9846f033cdf18d49780a207883c896d578978deea4f7e3f14380c677264efcb108f062ffa6263e0d5b43d207c4d30ca4542d54c4b726230b8917112d449dc28f5dd38fd443b33167b04c4d0fb979c3aaeabdd46b995e3672832ba74f5b0af4a0a5e4f9452aed95da921adbcb6ab8424ad6aba5a6219f3f1ea56e97e6059dc8d60f1e05465db6be4158df988c76daa51086a2267d1572c9d2a9b33c43bc972c56ce0814b43177d61d727b7798c74ea8f841916556b95df0395aabd8b0adfcf4dd84d74dc588f1d97827f61faee92e96af1019d2c22f3ed84111cab089a89c891f96aacf79c6a9c42e306ceeba186376be7339079da093479fc946d1be344b669f3893ce4c4cc539ece0790a82b2f656e7ff2defe366effe3165d5fa2cc2091f8072cd484ed4c12bc77a6cbedc0c1c38efab7fb69108349180d6be5e2c189e5f1eb8f9d2ac68605e3e5b310808a9ef1b4e8758a4fb8b7f104d684187f8dccde957badfe40b743c71e3d38a2d49ab634ffc02fe44fe64a9839ed6d88e684a4adeeaf29a751e8813504f4cb2123e20f29a42792db21637d6af23e844ae78ac42c216becfb265d79f66983c7a358ee7f65d52ce119f2c5b5f32a3132cb6850e53037a1facfe1ab1689fa51818957b8682d1585eed25bb8b5d9a8fd367db29e3c150cac43883422f13e1d89dff95e0a237f414d0ae189f2fd80849c539f2e31b042fafd3466bd134790bd23320b9e16f2e2bd3e4e456c538c8ed399c53dc316c2f1973d94d2f4f77db3b0b7647426f176c84740a29719a0a56e0ff7dcbf1483fc324b210c6f7cc165d240a54e140a5ea738e0b588a83b25206c1782368f537bbfa5ca395779c72fd18b8985798ca1bb1639351ff48be9903683db57499f14388982448ec75fdfb2492b6eed2a8e0433b56ff2308475f2c34ab1ee9666def66dbf371e825f8f1f5d9793e6f60354457f27ffdbcd4933b4bc41e11f9b3e3b98089ec96f347c756ca19f129c4cdeef8113d50adea15c5432fb9e0874513a00eab095f68d07654338362499ef35f6be441f488e1e77ceab598c4f8f68b8bca435277de8ec22ce5525a16f5f58ab53cc2ba31b40c7131489d152f24a2667e1be167de53fba0bb22a9efc71241153fbbf2b55ff2ce399dac1f5e7e401c5cc626c0eb0b908c2b1ec9934833de75215c5c7609bba67197eb1864a86f5decfd41369f74e14102b6af26d6c0779be3b1f13deba82e12e24bd1756af352eb5a1e7e41c58c14d0f4161f3787936a3f2fa82233760d6fc187dfb89307063fb6238dad30d4f8e19a75b82cdaf3c78c92e97a1a7e668945e7420940daf47d74e9c6a6a0f82e2115ebd7a88cc8aeaf883601e583d12d54f3c9d8a9f18cb5bb739d9ff09d4c57326c0c3b90748ad3db330a3fc3f735ee2f9da3a1d20e287a7b5a117d77380de49094b6af90a72f509d383b813305b1493b58d5315cd3bc11bda949a918a76bb1d11d453e1c1e3f535e8dced9ca8f138777eaafbc5a9de0ee253d5192147d0ad5d686b0cd927210fe4e726018aa5c6c0773130fb55cc93768b3203c183a5b5f4f911deb5654ee56e999217b20202e0b180ea30d24e79b05fc1f9954d57005cd7f57d74786cb9900b4d2ce9de6c065b0b0ecf8a944fe4f90c191ea5b2ead74238ba5d084739896b06f1d5363c0787eedd6bf6c6fa5ce42a08d55de5e0b1cd31fa62283929ad780dd4de1863d721e3f6b03ef94b93dc6f14b61a217c5fb868f7524b5fd2812b51fef87ea5e2a8c62a97d8f92996b3f33e7d3b7187641e3a621d6acca231f9bd7caf02e43f48870edbc8c65e71082638433d27b24bb4a354516bf41d327efc879142a863baec30e67079f8cff21bb2f43d1615f0d4f0503fd7a8dce90d7438022bed164407ecc44f180615cca6f68984a8d27a9c34768fb9474afce8f51a1c1e2422b917fb915b6dd772e0981551a5c979d8b7c18bdc3d1ae4c1f62e6529ebde01a34e5b321ea6a052c0882df4aa5711477b85f3312eafabcf7369bcc7d74c463c7e2e8f5705f7c7af9fa2d375c422c6eb10b68ce7b405101bf0e62b8007f2644f51970f4f1b21ffc5acec7d43575ee7c5cebc0a0dcd05be06ff4f728b098df5d0e88decbd1476e2dba0582947784f7db5826f5b79081b829937e76713d0f135c1edbab43ab6fbc0e14986fe2a17528dca2bf7da33dbb2f21d5dabd7bc2e83af04cd281f35abd3fb926341445acf099ba05d9e5f9c93ec3aba35ed1f90b5d4ba3deb53c92178ec90b3358bd6c4479258e5b294cbe61ec438cff6501e1811f093f69edb4d1fed89bf155cdeb175482fea5ae63d94ac9623e6e4938ff26c683367ac6f0da09e7979e50c1c3874d961ef94bc0f86a1314c3fee71001ef09801837f3257606c1932b9547190eb9becc32d19dab20a609319899d7da498b4b12a2a70ac59a948a39ab708f0cc70d05c53556b14ae1390a59c73215c9ca169f2bcc31877d11be9f3eb3a0b19110d1efc205871eedd02ab926ffe4e24135ab5318fb2d9e9bb744492b510a27176a3dd2d0d2dd55fc9c317991b67c9f1dcabae3854c4ca9b9e0a103d0bfd95e9ce9ba4234f0bf3c3bae8499b95633cf2e4afa116dbfb5a9a98db4442455a16d2932f16b543a91237795ddb2d40b24fae1d012d07bd040e07e896d4146e2c9f019654c1273f4934d11e502602c241db2a0a79103072d0c12d0249f881dc7c935fdd62810d1e5d707ec260e190efb8508ee90545e911641a81d2548e8ef69b58f586ccc4e722852c51adf394e3a8ec009f6d78e0b509e1513c94ca05f2ef8760105e3dae0657f3a449631b3525e1b59bc9e7fbd6fa4831570f630a45ae4c3cc6e2e4ca96134acd0b93fdc44c17a296097f83cdd5f5496794ef1d6c59b18a37aeedc7e7d07a54559de99f485cf997c62b9357a223e41f727c27f6d91233ba1b2c76de59ee05963b899858a917dd42ca0395384127adb144dbdb50a7a55e12773fdc4b0df7196658b1dd0af4554c5ec7f44db9fb42e6a6796a00f22d979129019498341b2c455a4bce3affc2c9b0c6604afdac6e11efabee4d01f93d86d2d5bdd33f6c4ed4e0390e701ecb62e68c6d1737c94dfcf237e2d89a5cd28b82597d7f6b8519bfc98c7c6a49cc169e3aad522f6b4e45a5e4d6d8b67cca2cfb13816d67025c7d1eee29e5f33c387928769c15d56bf49f50a91639bfa0145603b9ae9fc7c2b8015cd437e9dded6796043b91ee3badc600d5639897c90063f469de7fd0f7089a6b1eba9922634147f97e00733a27b553867b99faa4c502f793e8ebf6b1a0b7f70427ff763a8b872a3a877eaea7dc77c918474caac9afb35bb3419c03184ee415a2563e48062233b8ddfc3a155c619c5237003f86cb40416d514f860b5c00396bf0972850137cd934c309c7b3f8f3f27043e254800a24e66d450fffd4ad5c4a1898509160fb9eb208e943d91c3611b0b8ee0d65afdb94a908fa0fa52ce784e9cbf863b236e1f51014b9adb9c30ccc2d898747c687918b723262eab2a9d9f23001a306cd231f0c879a1b53fdd6c348920cd68e4f61f9a6203e8272a95319a8354956215ec874aa3d62743894a867ef55abbe4745e69c035fbfbc2492322d46303492c5bd851ec31aad56894d876bd19776124cd3c37b749fd612ff70effa9b3713903482f0ee490e6512c80ecdac4c699ef3db2247a7929bea348036cbeb6dbf5c93ae5b9678d543b11f00593f9a22ce67e3774c87af9b12512537adc44d0b4e633a077b93dc682ae1b5ad481ed28894900d147c48c28fa3d00dd63d82ce2569d0ca31e8eabc94bc3f165ded429eb1f2825ac0fe43a5d67902b08fa2ec9475eefcc5e527cc088c71b3fd4f5c03f3dbd2a2c63a4a59b04cf50241513fe2c4a06461a4b38c21d260c571f42c9a790924efdd70b4f678126c0e81d8a126d3949787ff5baa6e886f6ac4eca169ff176a50718345495940a10f060fedf7921228d3756f6a88d4c250e5d0755df6d1e561999575da779b963b9a8e47a96a0bbaef6d2e15950175b9b6b7ad19fe889b85c5668fd763394bbbb08e5d6469cc77ad946e056afac8120b2495f931ef701124069934c031f747f25f7838371afe7f2a37a3bc39859d116eebf1e20bcf25abe8eb025ed4dfd3022059de5fbdc9a1a4f9be8a8098b80d8bb6d449bade578c85e45e45ee811816dcb29a70ef7081b360059183c794d998080465d98f57feeaa5fe4d30c825fd056cf20c4af9c202835bb8032c46c339ef8a5dd58980b90c080438d5b710a744f8349645b9cd0b80f40148d6543d882e0215f116c475f7c5b2be5ce5454f760dc05a491c1873bffb4695e69c531c6ae6f8803a35b123c0bda7ba9ede565cfcb6310f654dc317336010a0abd8929b397ba79abba2c335a99ba640ce02827a04a3e4636f5fd6f52f8ca8dcb42efbafe6f9c102bf66edf0d29dfe75de9ce91ac3b240aeaf0f8355b55681a23f6b36cec785ef7c65b679268fc06785ebfcce19cf8559608ce28ac8f40b3f15a6832316ee0861c3f06967447286d76e514627287373da5533496f34ef5e8e5770521ea1813073ac5488dd210e70daf2fb275feaaa0c2520b89f772ab48facaef30a9c94022d7899485b362baf704ba22d4197bd54d7b5384ded79598e90498bd25d3f88dbd92de3f02b02f8e4686d36a0fac8d697492c45bbc890c62587679f52d2d341155c348c63d68dcc700f584989c26ef6e2a4315130872bb46411fc897f3e43b700af4352e2c513340c5ffb89aacfc86f0bee7220ac28b0440d4bc17ad5658a81d5af116cd2d924c296998bc04705a07ef5305202a3ce6dfddec92f109eb11159844b8602ff94dff9b3ac276704d800aba83e2185b80044c1cffacb2174582ae3aed1fb1217438fa4c67da7c5db0c13fb7928531c747ec6ccad3ffd8402c04b92233b86e67ac842a1235f70b25e0986ded37977660ccdc0143c0def05299ee39970481d930baa8283fada3b949af5697073d52f99f227bbf4f550144460b7c1307661626c0d97a857b11b152dea184bc0a0f1b6df7d611a727997c973c823c15db02f5231aa9557e8c50f2c66ed829af93e1ac82799add050cef46a114db6083130d22f8f27b908e5c06d16355f364febfcf9e3da979b931eb50060445ffe0c509d0d036336719da80ac0091e5f1ab4008f960a5b89eb4ce3bedd2e725c9b210a65edb08d3854f12dba8584cdeff40e0d0fb65bec4fc3ac125ac34cd3409674392650d9dc277c35ed5c763b9a24f7d32f8693346b72ee38bf306f595bf4d6bbfaf43b2a1382616f9969acb4dc21ecda0f4464ea35f5fe1df8f7a502af1e94d84d64c2f6dd1c86f450d4a492da01f7b7b31ecaa8aa769672778f39efe117bd0b5779d4991f025a6b2e7acdbe658b88e034a350b795b57ccb97b63f73858008b9cdf0149e0b685a8229e25489c49a270d6b6ad64f0ad122bf0b7871be1f7089169d26b7b41182d0d97fc119969852e4745c09e50a7d7ca013967509f9e8929f", 0x1000}, {&(0x7f000000b180)="29ddd4059a9477872337013e27d5a39ac952bf2bc738c32f715f5cf0335bca5cc3236d3216b7bdf21626b834cb9104af963ee0146408563fb70f030c32ac0fbd53093db262f7b972564cf6a208057f2798708605d8c042391ef110ffae78a9de98ff064596b1cf58bb2fa0619455b02a473ecde2f05f4e6299bc528e32455f5bcb67eacad5f7d1a41f0d06881e3f808b8547aedd6047c44aa0c607332bdb66841addc0ed053a39f436ffcbed2bb98580cdf10d9ec926186d7752c125d71a04702937315ef8", 0xc5}, {&(0x7f000000b280)="26f2d18f06e68c46687aaad8286fbf36d25ab3637ec07eb388695ab553a6bae6b3055815d9fa8a735650a7383ec4cfd0d55ef64f1315eabe6c52171425f8c4b28a37e301de5f5e1c7b095b351f0c0e0f5196ff24ff8585d3ecfbfd5483affdd35cd84cde8b2c9ae525eabd1b026786b15c28736e3cfcc1d7df25669a1d49c9c455ed6f395b1da808a12da1d94581adbad29aacf5af59a28c2bfca7f7a280cb03433c502ab4af0740e8f488f2917970ac872d8c3b839fba9edbd47622d41d1ad4e666ab479c405515b6b7b7ad77e75294f1f24d9cfc5866d165626f2a124ea43a853aeafe075a62f9b8864fae26c56aa84e91f3a1a926ad", 0xf7}, {&(0x7f000000b380)="746f0d628fc4225473ae00e65f685b5f2c2f7cf01595f9d6106567534a4f3c459630cd794463c9ad5bab1a31df485c32e0f028ca35f3d5951d162131735e0c755201a36c3e9c8e3be97f3048b83b75020894e0bcaf032510b7ebbaac5072bb8671b6b848ef6399153127326bef5b23f7cc1f148f286f917c49d6f528535199366d8df482289f47f57a58e29906a7e25ca207adb3bed2bd3e800ef886e3d2e675323b6dbd08d0f1d4d9d4ca53f36cdfea286e2f65b03c629f2d83867e0ccb6355269faa4f6c87d33f6257cd874e51dcbce9da2b2a5cd2e4ea73def3abfda81ef4", 0xe0}, {&(0x7f000000b480)="3059a8e1e89455a27c7fff42eb6747eb5588c22c963a9977b039faf9bfcbe55ff51d25d8eff388f75a50f4ff79c264cf5cc5288174e2a6f35f412acf462901274d9534a2ff5f2fa5e8dfd096eb22f67891c4e429d0e1878681b5fa251d1fe62a62bf6bf3a18349cfa7b240501a141c27bcd9b6ef5061c09934b9e272a76000b2cfb3d5f6f6a0bed147f2b9ed665f9a25777fc2bd4c79b0e8b01f77c57dac1fc5ce75dc75ea", 0xa5}], 0x9, &(0x7f000000b600)=[@rights={{0x24, 0x1, 0x1, [r2, 0xffffffffffffffff, r2, r1, r2]}}], 0x28}}], 0x5, 0x40) socket$netlink(0x10, 0x3, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000340)=0x0) ptrace$getregset(0x4204, r5, 0x2, &(0x7f00000000c0)={&(0x7f0000001080)=""/4096, 0x1000}) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c01"], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x30a000, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x11) umount2(&(0x7f00000001c0)='./file0\x00', 0x3) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)=ANY=[@ANYBLOB="b3bf00", @ANYRES16=r4, @ANYBLOB="010029bd7000000000008900000008000300", @ANYRES32=r8, @ANYBLOB="20001d801c00008006000500c000000005000c000200000005000b0000000000"], 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_raw(r3, &(0x7f0000000140)={0x1d, r9}, 0x10) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r3, &(0x7f0000000080), 0x10) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(0xffffffffffffffff, 0x8982, 0x0) 7.365221238s ago: executing program 0 (id=854): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-blowfish-asm\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) r6 = add_key$user(0x0, &(0x7f0000000440)={'syz', 0x1}, 0x0, 0x23, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, 0x0) socket$netlink(0x10, 0x3, 0x10) syz_open_dev$loop(0x0, 0x75f, 0xa382) mkdirat(0xffffffffffffffff, 0x0, 0xc0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYRESOCT=r5, @ANYRESHEX=r6]) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c800000000020104ba000000000000000a0000003c0001800c00028005000100210000002c000180140003000000000000000000000000000000000114639100fe8000000000000000000000000000bb3c0003800c00028005000100000000002c00018014000300fc00000000000000000000000000000014000400fe8000000000000000000000000000bb3c0002800c00028005000100000000002c00018014000300fc02000000000000000000000000000014000400"], 0xc8}}, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x4020aeb2, &(0x7f0000000300)={0x0, 0x12c, @ioapic={0xffff1000, 0x8000, 0x2, 0x80000001, 0x0, [{0x1, 0x85, 0x1, '\x00', 0x4}, {0x5, 0x3, 0x0, '\x00', 0x6}, {0x7, 0x3, 0xe, '\x00', 0x3b}, {0x4e, 0xe, 0xd6, '\x00', 0x86}, {0xc, 0xb, 0x6, '\x00', 0x4}, {0xf, 0x8, 0xf5, '\x00', 0x3}, {0x2, 0xa, 0x50, '\x00', 0x6}, {0x88, 0x3, 0x2a, '\x00', 0x80}, {0x4, 0x0, 0xa, '\x00', 0x1}, {0x8, 0x9, 0x3, '\x00', 0x8}, {0x3, 0x6, 0x3, '\x00', 0x6}, {0x2, 0x9, 0x0, '\x00', 0x7f}, {0x14, 0x51, 0xa, '\x00', 0xfc}, {0xe, 0xfc, 0x5, '\x00', 0x1}, {0x9, 0x2, 0x6, '\x00', 0x9}, {0x1, 0x3, 0xfe, '\x00', 0x3}, {0x2, 0xb, 0xd6, '\x00', 0x7f}, {0x7, 0x15, 0xca, '\x00', 0x6}, {0x0, 0x1, 0x4, '\x00', 0x13}, {0x4, 0x0, 0x40, '\x00', 0xda}, {0x3, 0x3, 0x6, '\x00', 0x9}, {0x9, 0x3, 0x1, '\x00', 0x2}, {0xf9, 0x1, 0x4, '\x00', 0x8}, {0x8, 0xc, 0x0, '\x00', 0x6}]}}) ioctl$KVM_SET_CPUID(r7, 0x4008ae8a, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ad060000", 0x4) sendmsg$alg(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000140)="439db5", 0x3}], 0x1, &(0x7f0000000540)=[@op={0x18}], 0x18}, 0x0) recvmmsg(r1, &(0x7f0000000dc0)=[{{0x0, 0x0, 0x0}, 0x14}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000005c0)=""/103, 0x67}], 0x1}, 0xe}], 0x2, 0x2021, 0x0) 7.261454081s ago: executing program 3 (id=855): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$I2C(&(0x7f0000000000), 0x1e, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[], 0x20}}, 0x24040800) r4 = syz_io_uring_setup(0x819, &(0x7f0000000180)={0x0, 0x69b5, 0x10100, 0xfffffffe}, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r7, 0x0, 0x28) write$UHID_CREATE2(r7, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r7, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2002}) io_uring_enter(r4, 0x1c64, 0xfffffffe, 0x60, 0x0, 0x0) 6.638448306s ago: executing program 3 (id=857): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000000)={0x48, 0x2, r1}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f0000000300)={0xc, r1}) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r0, 0x3b71, &(0x7f0000002180)={0x20, 0x2, 0x0, 0x2, 0x852b}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000052c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000480)={0xfffffffe, 0xfffffffc, 0x0, 'queue0\x00', 0x100}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f0000005480)={0x0, 0x20000008, 0x3cdb, {0x0, 0x10000}, 0x0, 0xfffffffe}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r4, 0x29, 0xd3, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000180)={0x13, 0x10, 0xfa00, {&(0x7f0000005b00), r5}}, 0x18) 6.154044511s ago: executing program 4 (id=858): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20, @local}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adff012255f674412d02000000880b5f04596a5e99fce658be2f200c699223886d8be4b50000005ab527ee3697f98125f30e6326996a3cfee33025a30b45bdcf2c69d105e5e55a1d273683623f1a5dc6e3c7e20eb7a98ecf3bd2cf898e924abe26ac296f660e69ba982fd76e00dcff7f0000ca6b78ad833488cfe4109eaf009eddcf21f5c63cde2f00150200000001000000520a0000151d010000000100bf00000000cc587424363da52001a3cdf2000000db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de406e89dcbb7677e65a88a8407a9e7f9c0e91028b0856eb1ed9474480737a55ebb0bd701f7fb21135c6172eba7eb8a341f07e5a2d1e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d93a433f50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56dbe37551b870b2851c3f0a1a9ebfcba105a6ccdd01b0f04edb256c0200000073f6db43661bd7f0e2536ffbfe5ca31b4083145531458b7d1e341c6b351ebc5223f54d6bec93f4ef088e5d1be2515226988d664709ff03f1aa3dc7f1580ace9bf2afd28d0700000000000000d6eb372713255012e028cb2654d493a0b43bf21375709f348f5eda2967199cc936859a538100070000000000dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0c6ef9dd2b6bb700000000000000000c586272c3f4d79bc36315745cb149f3cb385e6add14652003c7cdd3324f07d134d3a6c718bbd1aafe1140cff0be4c6f8df084c5e9734ae30aa9af030025f01ab03a9b1074407136bc506031f0916a39d3057d55183612b39e73ae8e6dc30356886a831836469e2051d937eb85f3f2d5ae2c1dca476b97419a3b76ed62409d004d7fbe362145d19605d760df4c5124ca325d374b371867a79b35c6617fc3327191fbf514573f0e30d1d60be2168fffc2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc9110971b749ccd74089ed6b86f81ca3ba47d8f71d290ed1b1a11f7a67125170c88c3b6a50692cc0064fc6bbd312536ac15016c85c6332226401b110da9c786eeca22debc99335587b54c13c3107008fa069af8223b38ced735c2d906551004d8dc10d88738488da01ffa4add56474573c964a270000f2f16625c0c10200000000c7a5ca60fdad159f2e44171f39638410020000004825d081f2d987f05c534187738655d7dc958f2046fa0c1619a6554b82d9c162eb61ca74f1ffdaccf0ea5f06e0fca8b27ff3983ab74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb27f88dba816020be760f7b45e001efada8000000000000fdaf4660402f7b3b79a433e08074ea2462974a00040000eb01352638f56dae0249d15ba8767259658878b7492cfbacde9b57cf4de00788adce638190f3570e0b4c80ef682df22201270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433e866665b98ca2002c804c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc76d7a23d06acb1d2d4c58faea84158bb440df2a694f4cdcaa4f65c22efffffffffffdd00000000d503d79986958115ae07b70f991430b7fb475d77b869ee02000000000000000000001ffff0ef89b2a68d2b05c995445d8a7700bcdfbec74fb2dd163e863315e84498dfb52bb93f6c9084659ce777ddac563c8596c2b1d8180289a61faa95a82bf1cfb7f2fd7252e9322abe282c33445d443a67467893b9bf0d1c8130ae6b226900000635376413c29f7c6f7b7e29b9a0c64e68328661f0c06e21f7d7dc22174ea4447a6f60edef3a4168d40200fbc71104512efe8e5d7d934aa289b4bd2b870000000000000000000007000000002000000000009b777883a02f0593dfc4cb4114b9f9cf4ad155110cc6ace2b322ac31bfa27847c799c8009a1ea5b98e525e6383ad7fd9795170e7b11e247603c2ff49a11459c7f606d729d3979676bffb3049166bb84a0f061991bd57c2566c10c282352aba05b6164ef876915a3f2491e4793e590dcc71de10da96366c1e992c0068c940dd4422c9882d3aa0f8a797b8fea6efcfb5276b7679f15559edaa977504cc0b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd04000000de17e1e13b93669b79556abb722d9c085b189b5fd1f30e8dc813f608830b110001732135e8e7262f290000923bfb6b41ff3792cee2fc37eee739c3e36a4bc80112968ec0d8902eced1fe552018014a463abbbf7ccd6a92a5734e3ebfca9b6e88e031f31de2183652e77c164c646a1cfd3710aa4205d8d4d4f974133ccb1e49feb42664eccd809c0ba8917eda87489e8946d5c8156197bcb66fd5606c63e3389ee9e8552381646365066ef9a36a449c96485c22ad1aa423b7b89efbc6cd54000bb0ea5f4f1e8773144fb6ac9a44d43593d77e66aa7ed7f3d4e7b211590c738888d02b2dbb0b2ba73ec72e1d8d7360a128499dd19e1e7b9b0671f4f58515b45ecb9964f3c4ddb8234391d514f8d996d8d6dd7f8fadfee2d7a0035638ce27c2936cb04b30a0eb0cde0000000000000040000000ec3c12ecee8fc3a40000000000000000e215b00ce2570b930723cbadb4033d1b8aaa2cfb3fb89e4a6e89737fd6232218a9e0c099d1eb59d60b3cca089785642f327139bc4394fb6d547a9b3c22599e780c1da7433fb47615d372e3fffe9703e37d5c87d513165278650738efcc04d27b766cf7f60066edd292f6c8a2174f391ed164bb1816819ceb3e378e776d422bc946cd9501accebeac3a5b31d8abc68ae537cd44a04e6bc21c35a7beab2610c51e593676bf635a20f597f4631b91454d182f826071f5210bd6d93173589929b23801e63c2266fde13b5a04b8d48be057c752bc415a756ea9b4d34156c4f73dd5e5924ef101a5fcdaf37c7ba2c4a9de9b000000000000000000000000000000a73b862e4b63c245616b522345587d0ee65a6902bdd0abd941e8aba37510b222ae544f395edd1b92ad53fc68f08ea00edc5e10d768836169dd296d56b306e8b75778c37571792a6c3d8b02ef378ebd59422cdd008bef6f80a80a68641ea5ed4f1126bb676098c10bf663eb3fb8c839364d28fd046dc64b35f9c3397ce6f4ad357b0000000000090000000088c7a8e2638f650a6f04a6f33a090f59414d6ebcbc687e66d600000000bd0a58ea6d36fc2cf9b9a71c137a2a22adb1006f371d4faf47285fd66fe0389afb96854bb360edcdf11b4ff6dd578bba93e949d240cde9b5836cb46032484dc19c93db7b6e5afa10547c78e76a3111557346e52566df196fd630561bb908fff4d2e19562aabd43742a26a43799f8636fa04ceb40c9e4ca1cfbbc7b949cd245a3ee118fd0d4f639444539af8766028d4ac4d4c548e290199e0dacbb4f6796b39bf32934d941ba2f88e3ebd0cf8e24f99eca86e4ca9b2cd2b54044a7fc4631572a6378a32df288785f146275c1f548e2a0c1016744e05f9de5044373d7650125027547eefe7b2d8c8871bb65395fae99d8456883705bfdfb00001854b2e5efa8aaf25827d659f592b1575281ec125de7fb91cd81d91dcb19f5cdf1e1e2b4a8a1389753a09110538689e38e07fb2dc72bd4fd11d7bc16aac5d85c6101bb722895248e463a5fb45ce0e564e90cb19d5993b471687ae4165e29cf2f58082115f5f8569896eedfd798733223e6d6584997510c374912ab798bd4af4654c01bb2c411bc36468ddd62b4eba5cfc8953526e0e5b1359797956152d0098ce47c62c3fe5a23219389622b7f65bf03527d25c3941b9cf1ffeedf6d99082bb57ea871c12213cc40900f83033bc18c529171fae324c315bc6ce358831d0230412212acfd5fc8d5cb0d028cf568e8bb40e27befe2ff01f7c6674a4d86d900633ea36641e0a781ea0ea7f2d928b8b22e2f97dd13348927375baea6863bef4acf4299096ada5cdd2a0eaafaa760a79d102d1e0c0000000000000000007926653b8d79ce16a432f124786a0bc3c5b7d196822492ae1ccf91aeac16406ad6f9cd3d96d57fceba8360ae49f73351814c9c2972f11064aaf3739d9100f9c0e4d0cb17d50c82e305ba7d62cf1cc6da26e34982a8c74dd8122cf5b5e7c34fd2712a0cef05e4d8ec7dd363219676bd9b19943185b132eb35a695e208dfa5cecdb1d6425c8879063c0f11bd64291a4209ee6dc1d9e9010013f6148c603e6a335e298efd6ab5cccc47a2c568c6afec54f8251bd840752addf200371361c9eedf05ed98585cf6d99e9e56055064bda2d373369761238c278147cd0eb7799f6b9c9fcaa3fd282154994f5b25420c86db9b6401e885de1c615a719a1c83e8fbbb181282dbaf3313a4e4a4877e9f37607e2cd6da0cf6371ec06a75f5a4206b2418ad8897ae149085d63f01f22eca44033234b3930b4d5da756669a1d59d69e7de54abf439988ed7ec33c2d0a901bb0985a24878984d8a4340fa9a356d100926fb5f2ef9976366a61b8cc2bcb1c072b0e9c564852388e1edff10d75b3832792e471cc15b40380f94d834243080158603fbc9134d6983c540525447478984611c0d9666941bfc0a30db47a8828b6e5c51aee2094599b4ce52795750e1764f1657ca8c5633c71287239dddf5c651496f7bbd148c937f083d2e4e0197dbc6ff0649c749707b17399b1d7efad23abb8b40b38704737e15662ae4913a4a001cd3b71c7af75b5ffad9780650c800a40ca80ddc41987919142fd28dbf22db5f4c435415a03455e1d55d1783ccef97d7e4655cf839d06f06e137bbe462a03b3100231914b19739dd57b4f12d026ad0c7fd3"], &(0x7f00002bf000)='GPL\x00', 0x4, 0x436, &(0x7f0000000040)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffc95}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000180)={r0, r1}) sendmmsg$inet(r2, &(0x7f0000001500)=[{{0x0, 0xffffffcf, &(0x7f0000000b00)=[{&(0x7f00000002c0)="89", 0x34000}, {0x0}], 0x2, &(0x7f0000000e40)=ANY=[], 0xd0}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}}], 0x2, 0x0) 5.244163648s ago: executing program 2 (id=860): socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_pressure(r0, &(0x7f0000001000)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r1, &(0x7f0000000080)={'some', 0x20, 0x2000000005, 0x20, 0x10000000fffff}, 0x2f) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="7a0a00ff00000000711053000000000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r2 = syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000080)=r2, 0x12) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000002d00010026bd70001bdbdf25040000000c0016"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/schedstat\x00', 0x0, 0x0) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000200), 0x20401, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000240)=0x8) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f0000000080)={0x98f, 0x2, 0x1, 0x7f, r8}, &(0x7f00000000c0)=0x10) syz_usb_connect(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="120100006e383a10d00701415cec0102030109022400010000000009042300020070400009058a0308"], 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_pressure(r0, &(0x7f0000001000)='cpu.pressure\x00', 0x2, 0x0) (async) write$cgroup_pressure(r1, &(0x7f0000000080)={'some', 0x20, 0x2000000005, 0x20, 0x10000000fffff}, 0x2f) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="7a0a00ff00000000711053000000000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) (async) syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_procs(r3, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r4, &(0x7f0000000080)=r2, 0x12) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000002d00010026bd70001bdbdf25040000000c0016"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) (async) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/schedstat\x00', 0x0, 0x0) (async) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000200), 0x20401, 0x0) (async) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000240)=0x8) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f00000002c0)=0x10) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) (async) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f0000000080)={0x98f, 0x2, 0x1, 0x7f, r8}, &(0x7f00000000c0)=0x10) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="120100006e383a10d00701415cec0102030109022400010000000009042300020070400009058a0308"], 0x0) (async) 5.077897135s ago: executing program 4 (id=862): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1, 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="6a2000010010000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x103, 0x0, 0x0, 0x0, 0x10, 0x820}, 0x94) 4.909022655s ago: executing program 3 (id=863): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x202400, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x10) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4a, 0x9, 0x6, 0x0, 0x3}, 0x0) add_key(&(0x7f00000000c0)='pkcs7_test\x00', 0x0, &(0x7f0000000000)="100c0681000000ba8b0ad775b31b", 0xe, 0xfffffffffffffffc) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000140)={0x0, 0xdffffffe, 0x80, 0x0, 0x0, "8100e1c8e80b598c36ff000800"}) r3 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r3, 0xc05c6104, &(0x7f00000000c0)={"000600", 0x4, 0x6, 0x2, 0x0, 0x4, "0000000000f4ff0000000000000500", '\x00\x00\a\x00', "0300", "fcffffff", ["50d5c2a7c5ae5cace40000b6", "808e88e2e9ffffffffff00", "0c436d743c97c443084000", "ff81000000008000"]}) ioctl$CEC_TRANSMIT(r3, 0xc0386105, &(0x7f0000001080)={0x5, 0xd, 0x2, 0x5, 0x5, 0x8, "96f865ac131bf78cd2fb00", 0x8, 0x3, 0x8, 0xfd, 0x9, 0x0, 0x6}) r4 = syz_open_pts(r2, 0x141601) fcntl$setstatus(r4, 0x4, 0x102800) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f00000010c0)={'dummy0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write(r4, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x582}) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0x3) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x0, 0x0}) close_range(r6, 0xffffffffffffffff, 0x0) r7 = syz_usb_connect(0x1, 0x24, &(0x7f0000002140)=ANY=[], 0x0) socket$inet_sctp(0x2, 0x5, 0x84) syz_usb_control_io$cdc_ncm(r7, 0x0, 0x0) 4.835968892s ago: executing program 4 (id=864): r0 = socket$packet(0x11, 0xa, 0x300) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f0000000000)=0x1, 0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x123000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="010000000000000082000040"]) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r4, 0xd2a727af3cb3995f, &(0x7f0000000900)}, 0x10) socket$key(0xf, 0x3, 0x2) timerfd_create(0x7, 0x80000) r5 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = fcntl$getown(r2, 0x9) sched_setaffinity(r7, 0x8, &(0x7f0000000100)=0x8000000000000001) r8 = dup(r6) getsockname$packet(r8, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x190, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r9, 0xb}, [@IFLA_AF_SPEC={0x170, 0x1a, 0x0, 0x1, [@AF_INET6={0x2c, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @local}, @IFLA_INET6_TOKEN={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @loopback}}]}, @AF_INET={0x30, 0x2, 0x0, 0x1, {0x2c, 0x1, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}}, @AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x8, 0xd}, {0x8, 0x0, 0x0, 0x0, 0x38}]}}, @AF_INET6={0x40, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}]}, @AF_INET={0x28, 0x2, 0x0, 0x1, {0x24, 0x1, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}}, @AF_MPLS={0x4}, @AF_INET6={0x88, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_ADDR_GEN_MODE={0x5}]}, @AF_MPLS={0x4}]}]}, 0x190}}, 0x0) 4.410902177s ago: executing program 4 (id=866): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x80002, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f00000000c0)=0x3) syz_io_uring_submit(0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x2def, 0x2e0e, 0x0, 0x0, 0xffffffffffffffa2) mkdirat(r1, 0x0, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r3, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200), 0x4000000004002, 0x0) ioctl$DRM_IOCTL_RM_MAP(r1, 0x4028641b, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000751000/0x2000)=nil}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000280)=[{0x28, 0x0, 0x0, 0xfffff018}, {0x6, 0x3, 0x5, 0x80000000}]}, 0x10) r6 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r6, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000080)='disBard', &(0x7f0000000200)='\x00', 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) 4.140353514s ago: executing program 1 (id=867): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$I2C(&(0x7f0000000000), 0x1e, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[], 0x20}}, 0x24040800) r4 = syz_io_uring_setup(0x819, &(0x7f0000000180)={0x0, 0x69b5, 0x10100, 0xfffffffe}, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r7, 0x0, 0x28) write$UHID_CREATE2(r7, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r7, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2002}) io_uring_enter(r4, 0x1c64, 0xfffffffe, 0x60, 0x0, 0x0) 4.019333261s ago: executing program 0 (id=868): socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000200)={0x0, 0xe3, 0x4, 0x1}, &(0x7f00000002c0)=0x10) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x3b, 0x1, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0, 0x80002101, 0x1}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}}, @NFT_MSG_NEWCHAIN={0x20, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x5c}}, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0x10b, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x800}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000540)=0xfffffffc, 0x0, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185500, 0x12345}) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) io_uring_enter(r1, 0x7277, 0x0, 0x0, 0x0, 0x4b00) 3.382160913s ago: executing program 1 (id=869): sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x4000040081, 0x80300) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x800, {0x2a00, 0x80010000, 0x0, 0x17, 0x0, 0x0, 0x0, 0x1, 0x1c, "fee8a2ac787c179fd1f8a0e91ddaaca7bd6447a4b4e00d9683f6a1af1ea09de2b7fb0a01000000000b00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c9b40f45f819e01177d3d458dd4992861ac000000000000000000000000000000002b16", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000340)={@private=0xa010100, @local, r2}, 0xc) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)) unshare(0x28040680) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x89fd, &(0x7f0000000040)={'bond0\x00'}) r4 = openat$cuse(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r5, 0x75fa, 0xe475, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000002500)=ANY=[@ANYBLOB="b7000000010003c3bfa30000000000000703000020feffff720af0fff8ffffff71a4f0ff0000000065040200000000ff2d400500000000003400000001ed00007b030000000000001d440000000000007a0a00fe00ffffffdb030000a1000000b5000000000000009500000000000000023bc065b78111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e51815548000000000000000275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7f300c095199fe3ff3128e599b0eaebbdbd732c9cc00eec36574a8f6456e2ccae25ea21714eca8cf5d803e04d83b46e21557c0afc646cb7790b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2400000000000000800643a98d9ec21ead2ed51b104d4d91af25b845b9f75dd08d123deda8ebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987af1714e72ba7616536fd9aa58f2477184b6a89adaf17b0baf587aef370a2d426a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d64364c82770c8204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee7d26b34381fcb59b854e9d5a17f4720082f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67051d355d84ce97bb0c6b4a595e487efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599ddd71063be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d96c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d38df9ba60248d9a0d61282dfb15eb6841bb64a1b3045024a982f3c48153baae2c4e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c3560811ea6c3560a43364d402ccdd9069bd50b994fd6a34ee18022a579dfc0229cc0dc9881610270928eaeb883418f562ae00003ea96d10f172c0374d6eed826407000000000000004a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea52acb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d851680f6f2f9a6a8906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f4ca2195234648e0a1ca50db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145eb6dc5f6a9037d2283c42efc54fa84323a3304f41ff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f928ba7554ba583fef3ec7932f5954f31a878e2fae6691df8b4b7ecd27ce82f7df3e7d1daac43738612e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e96735600000554f327a353511ccedde99493c31ac05a7b57f03ca91a01ba2c60ca99e8ebc15ecb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d40460780000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120968308c31db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd0000000069ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a003fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9e0600f86909bc90addb7b9aee813df534aac4b32fd691b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a000000000000000000000000000006acc19808d7cf29bc974b0ea92499a419aa095e203c1bafbb9b9a7c2bca3f0a18ee4952f2d325a56390578f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa84feda91f3edb32231ec75300000000000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b88b5e7885e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035ab63de71a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db1829f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2744c46570e8f46da1ab990ca053cbfe801000000000000000000000000000000d55d7182af2ea5f8d0ad495e3eb9421963a5a683c3dcb2d300aa3b2cfe946d2348c35f5d67d68ac07c8f84b3679e77c2e629ecec7c12c35d6b6971b8ae13cc00956d2227db60c0a461ed2b3ecfb16d19037c8c88c91dda1f904fbbc864e95ad43d6dd6d5eadbcea25682ba4b91e14c3fbfdfd1d680aa1af102d97681656bf56ff0674237ce097d39008cc3257778de878bcd37467386f993be6d20c93a7791e7f2a155ce379b4cda2500108052aeb9bd03ff6d4c5dbda9ff485d6576a492d436d52edcd420e7deaa4343a0add3941ae7c5f58af43866ca64750f43e583ca1ceb3a805e46beef9dca77a4edcbb42aa0caf0bbd6cec72d85540293cb4849b0610800000000000000000000000000000000f9814d5f6c8673c143ff2f901e71b8818665b56f7a03afe3d900007656859db4cb06aaaf9f02cfab5b9e61cc00e8e19429921b8df4c4c53bddea4cc48737842952ff08aeac15685df194ca89da8cf6d29a2be9779181fd5d105af5786094d9130f5826b18b9667b971a994f3fd069629a1052f441e96884f90c91f4a974242aabfc8adbadc9ca27955b5c90f0bd9a46ed044272383d3768871a9c8cfd7948aea445c55684351002ed4a4af45341de8e5e1f33624bd2ec1591dd00bbe05000000f89a928662e9b9449db34394fc5e946fadaee576e28ac0feab4e3585ed43d206218f524083840a78b7236bb7f5e42b5376642f8ad4028d4ead407240e7467d1b37afe20690d7672c7e926fded95cf805516ad836eb730619a05af36fb28329d6feb33219cc9164461a8ba3afd5949b9a6046c53663df30a049414089c1ae8f3476236b05dde8dda4843a62c591f8d2b1a62d0db8dc826219bd87398b33e140792297d023ef52de2e75b9dbbfb8712ccc15c69cfb4c6c1bc2ae74621e536b9d3f09a15dada1561a8192d65cc59d7ed5a6bd61000000000000000000000000000000000000000000000000000000000000000000000000f637782e317d492b2392fd0ea81397a80227f271bad21d688af35a2bd02c15d20f3d62a50e20260642c25f304c8034a5f4d8e45e701dbd84294d1096e715662b8223e10e98c4c38451fc5c702084e3fa9b184e0d0fba44acf3bb8a846cf680dfbf312cddfdb2043288fa6b67fa762c8b75d4478756ef240f2b314e4d77a3afb4fcec92248327004d1dac7ac87a6f8cb04d82acc307d60e4713bd9a8f29091d3048c669a5f5439e0a906ce098d177b9579882586511cfe6a23e57c44d1654899f077b5636e4181f3de6b814bedcac5290ad8018bbe4424edc6d9b0e61b404bb7a2d4883bbc200de8332029cbc04a0bc52"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) write$FUSE_NOTIFY_RESEND(r4, &(0x7f00000052c0)={0x14}, 0x14) r8 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x208400, 0xb2) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)=ANY=[@ANYRES32=r8, @ANYBLOB="87aee87189baabe7405843c85376eb958d2821c19e29c5b9acb54cadd816eb6da89a245f90c2279d14c00a5dcb9e97c4d091cda3b4afc3432cd777f4a40342"], 0x20) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r10 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socket$nl_route(0x10, 0x3, 0x0) write$tun(r9, &(0x7f0000000080)=ANY=[@ANYBLOB="0800080002010900680000800900456f009100660000401190780a010400ac141427bada4a4fe93b7378c10200006279cb22459ff50866ff829694a603d3c443eead410baf7b350c12fa15932138ee8f6a6d2afdde33d5a4298b32860f7d3d68030697e95d9cff97f976b3ac6d8c10e10601a959b4bfa74aeb66e47b253578aafbf118b7d52cd3b5a4c19759c5eb55c033fbf5a6cbeeb311de39eb228702b8"], 0x9f) 3.277900382s ago: executing program 2 (id=870): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x298, 0x2e0, 0x940c, 0x3002, 0x2e0, 0x2c0, 0x3e0, 0x3d8, 0x3d8, 0x3e0, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x80, 0x0}, 'virt_wifi0\x00', {0x6dbf}}}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x0, 0x4, 0x1}, {0xffffffffffffffff, 0x3, 0x6}, 0x5, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f8) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB="3c02000019000100000000000008000000000000000000000020ffff00000000be14144416000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000084010500ff010000000000000000000000000001000004d2330000000a000000000000000000000000000000000000000135000001003b00830000000500000007000000fe8000000000000000000000000000aa000004d63c0000000a000000ff01000000000000000000000000000102350000020007007f0000000000000004000000e0000001000000000000000000000000000004d56c00000002000000000000000000000000000000000000000000000004"], 0x23c}}, 0x4000) 3.079692003s ago: executing program 2 (id=871): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000000540)={&(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000940)=[@cswp={0x58, 0x114, 0x7, {{0x2, 0x7}, &(0x7f00000006c0)=0x7, &(0x7f0000000900)=0xb, 0x16, 0xfffffffffffffff7, 0x8, 0x5, 0x2, 0xb}}], 0x58}, 0x0) 2.85064446s ago: executing program 2 (id=872): openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) add_key(0x0, 0x0, &(0x7f0000000100)="305c0605e182d1447ad1ad837003", 0xe, 0xfffffffffffffffe) r0 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a9850a9", 0x5, 0xfffffffffffffffe) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f0000000040)) pipe2$9p(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RREAD(r2, &(0x7f0000000880)={0x706, 0x75, 0x1, {0x6fb, "f1707e7140b694c3ff62b041f1dfb7523c06696271340b6da71e52ec8881ecde0f38ebe7a6a522855fe5f5f23e570062d9c78f9f952d24be478a4f0b98498128ae9b708f7361e93ebfa735edc0a3e05284c4d20f70ce2ecbef671b9c8f8da03ba47b2c1b400a824dc4c0761deee5e6bc532b337a92b48855504b302516da8fd4870770f6818271dcddbaad940dbb46f26d403a00532f5c2d75206d8a35e0d757cfc875f6531dae920195c14564486f16eb04469572f6643eb5a66c799db75155c9e5185ae5c49cf9109b5b19bae83e3764937622597544c133c018c382fbe803a7b542b991243aac0fdee5c6178de4a40c6cc50bcb5ef3e8801141c649f174451be1a2d9b9d2cc06c08ab9a3b317d27bfd2ef6347ae246a1583c3271647ac00bbb1787a295915374c9f01db4af090b84752636e460e5d605c660299b4db2cbeac913c0f441a4a35885db0aed1704187eaeda715bbc8b5357adc117ff7069c88e5f178fe2583408b740225ad3e49fe8df9d906ac2f136d91562e84ac76f09e4b5637b1384fb071793cbf1356833ac172e69fd229bf134cf7dc2e5fa90ee233be4b736bc372aee29fb57ea8f0113a4468c8f4c9c7800d3cbcd8ee9029864fda9d4d7512e73c0109372b0c8b1e59ede2a38b79e0bb6086c0a879417a1abe92edfc2020f661656fe4f121af61262c1bb1e6341150d6c6395293c2c6068e06179518e52f6a72dedaae206bc0607af81c05e0602b68b52f102b3420aaa1c1d5e593ab7c69b89a86ec69b963df102caf5d4a630f800e3d70a297927f0a3783bde3444ba8f5a0b8227f81a235e5fb0d4033c123aa3314197b5ccf2d4e597d2056fdd6f09ef2d4bb211504e52ba5d0208de28bc0495c87a011764a2b0d6920fe354d17df8178978106813bb38fb58da881f6f6cbd7df31aa9b220c55e1e1bfdcdb1b4d5c6cada8c95fcdb728f24f7d3bb34ce76c0a98a462c0658ba196372861f8fb3dfea08bc68dc828220908d0507f07d4bbafc000bcbc0274966e4bee1eec7c02eb2b13f27948c397948e84242acae6730204d033c10b946b32bc532888147439812ee2cb70b608a11272ad2eea5cc29d0903d92998c192351e897ac2880a566d21527eb1a1071178dfbc3de66c3d6069d919f4a3dbee21eb388cf5655b484c5ddd84ee63aba74fb44d68905d66990c8c3d850275566d6e11be09a359f25fac577812e1b450bfb6a81d2b35e9f3b851d42586c38e661c59457f1a78feccf67839f33771c1c6a0f926bd86ca1f347beed6055f31e4e6dd8f63e19819924f3283beb5a35d13de75c4d55784a3a280814d2ca3383a03b354820503320503bf74324fc5dd5d8396c9e610f10fa3bbd456bbf78937d7b727e59125c988378d7cd76fa61011d78148fc7c83fdc31d6f34a2174d75c1cae62c286c009f60bcd3cd29ad2a214d884bf743aa76faf82afc28994eb8925a23ac92f0c3455deb513d4860acad2a5678ec10c4d29b7c499605e0e1f83910accc6f6d118dd211590db7f12ad04e56094aeb05314e06ec5a3c568b8763fe3411963f3a71d09248102e96eb6cb091a512b47cf825481c4229da13c4fa6ba237d84e4a798fcfd1dc4dd5e7bbd99df58fa1f08c18fcf8c2fed2e9891b6c43b29d02b78fff375390c92c910192f25f2321be44e29d094d1106177e04af8f6654e26fe6713d49c2840295de20c2e78f241d323b1eced46996fa2ed7e5344d66ce001f29e523a840304bfe68c4aa19a3c3d70ab06f383e76dce9593db535fece6661f7e1093bd41e78d9efa4dd3c1fcd6499e26f63af7bf6133991b03a0f807684963bd62caec7b92618812f435e21848cb742d5ea2a6b28e55e66bbb1ac5045684cfa6725a8234968f9b827a4e25ce4d36424af35a830b91260a57d2872e79dd243363d0be6a9ac80b33f82b46b0fb0e52d16ed16f54312e314e53f18f3ae09c9958e4c4d4e8a5a6695ccfc521e1b579cf4a699ff418af8af9e1a2432251c33770f7445cc6a4ad8314fe44844d167ba21478b6663274efb90f96989f79aaf7e8cb824339b400b2b0b2ab97170644bd6ee77c4144730e3f1efaf488fd1d914bbb4bad0c0912b1819e8b1632d94ebac776a0581d0e0962ccefdc7160d9d4088efa91308ef973cb7925864f2eb8cf7b9bd8419cf1bbf8ef0b975fd8d82255e793c60acd3f612b83180f9454ea57fae41d03c61e3bf7cf694e8aa25cc3d03aa0a290db48ef9fddfcb90e27d85e438891c06657a247ba01224a7473c17176c57099a5aa52f0adb6e144158832d794a522011cf2fdb72345f81209788de2bbb5db9c8434f40c38017b88870de66228779905b24201e7a5d021125d6a02bc2dd4406547849c1060710df6d19f89bd2255d055a99704a5f5b0db841b48b7c4ad3cc3565fe42ddbaa0d507d143a127f065644b3123af6ca12bb088176d24f4cd366adfee0eb6b61e9dc6f0b5de2d75203bab770a3b56bb5cd98e23db18cb9aec48f12f6f146cbd01d027e9bd982a5817a08f9"}}, 0x706) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="48000000100005"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x0) r3 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r3, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = socket$netlink(0x10, 0x3, 0x8000000004) r9 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r9, &(0x7f0000002800)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0xf98a, @dev={0xfe, 0x80, '\x00', 0x2a}, 0x5}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000100)="93", 0x1}], 0x1}}], 0x1, 0xc010) shutdown(r9, 0x1) getsockopt$bt_hci(r9, 0x84, 0x6c, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) writev(r8, &(0x7f0000000000)=[{&(0x7f0000000100)="58000000140019234083feff040d8c560a060f0200ff0000000000000020ffff00000000000064009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd0000000c0001000d0c100000000200ffffffff", 0x58}], 0x1) 2.273926676s ago: executing program 1 (id=873): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) ppoll(&(0x7f0000000100)=[{r0, 0x1}], 0x1, 0x0, 0x0, 0x0) write$P9_RSTATu(r0, &(0x7f00000008c0)=ANY=[@ANYBLOB="5804fdff7d03000005170300400000200000000000000800000000000000000078a0090000000000000008000000000000001b00046e6f6465767b65766f6f7e2539c60005000037d93a8b92000000600275aff540c602007dfa673effeb09b5351f5bde05400097f7502e7b8200b500002b595fcb14034354b9fd9ef196a51cd5157adc8103b494e165e12cea48597c664646c9a70f3e49253371c0423877458ce943c5ef03b914651fa3b84f41696b90141623d7c143441930dff256f6e8d4835d9b3ba5a7744b50be209678378326184f4ac3e0c3681bb95075f3847d2b732cd9bd96fb984d84e69ba9922793d2638486d6780e0b852365f038b00c11c5d4590843bc72a59fa4a373129e32382a15cf6c885709fa1a73448d94de89651ec28c3bdcc3d3b959bd7ed071ab5a5be0fa291cf115abf084c7bdfa150cb8e4aae2d85457a9af02742343c13ae143cebf987b2248806b459b5a5fdd5aa5bb90a57ee1f4e3544bd6d1b4ca137975738080c468674a6b73a3df28256e070033212c277b1dc17581f4c6dddef3aae3ad6dcaedf4f67fdd3794832f894d106c9e8dfcd263cc09c05c15e6c4bfb0df6d5ad607ee0705eacc8a20aafefc22885fb61ef57bc80c3054027460f647d123d48a5ffc6738abe1c940099678452dca5cc176b6b66dca565ee78325b921646ea0d8600f1e2f7dfcd060d4b7fef2e0cdd3745e909a14aa035703e86dd95b3c824f3e7b24fb287fe8b3e3197732f2638aec8d6fa59da7c144b3a1245b2b35210a0e6c3ab21eea23a4de23f2718a08228f12648af5b29f91db227e7afa034df13c5fbf106b97a3002484b4abbf7168c3321833fee63399ad1ebb7dd07bd7748c8387f6d504bfb9882c928b4195baf7b835aa7006e4b3d8b751ece41fc818bc5eeee69732e2129143003c2c8934b204"], 0x458) 2.11015225s ago: executing program 0 (id=874): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x20e, 0x72, 0x0, &(0x7f00000004c0)="b9180bb7600a070c009e40f086dd1fff310005e03300fd010010ac14142ee0080001c699da153f0ae0e6e380f60115f683317585d7473be0ab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644b", 0x0, 0x31, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000ffffffffffff00000008000400", @ANYRES32=r1, @ANYBLOB="06001500030000000c001680"], 0x38}}, 0x200400d6) 1.683582648s ago: executing program 2 (id=875): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$kcm(0x10, 0x3, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) socket$netlink(0x10, 0x3, 0x4) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e000ffe00180002800c0002211c0000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}}, 0x0) 1.517700426s ago: executing program 0 (id=876): ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vxcan1\x00'}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000100001000000000000000000000c000a20000000000a0300000000000000f400010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c00038008000240000000001800038014000100626f6e64300000000000000000000000080001400000000048000000180a01010000000000000000010000000900020073797a30000000000900010073797a30000000001c000380140001"], 0xe8}}, 0x0) 1.241509032s ago: executing program 4 (id=877): socket$inet6_udplite(0xa, 0x2, 0x88) r0 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, 0x0, 0x1df) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) unshare(0x8040600) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) preadv2(r2, 0x0, 0x0, 0x7, 0x6, 0x8) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0), 0x60100, 0x0) ioctl$AUTOFS_IOC_FAIL(r3, 0x4c81, 0x2) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) syz_emit_ethernet(0x36, 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0x40305839, &(0x7f0000000000)=ANY=[@ANYBLOB]) socket$inet6_mptcp(0xa, 0x1, 0x106) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mkdir(0x0, 0x0) write$FUSE_INIT(r4, &(0x7f0000004200)={0x50, 0x0, 0x0, {0x7, 0x24, 0x0, 0x53f6663484e6643, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x50) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(0xffffffffffffffff, 0x40045010, &(0x7f00000000c0)=0x3) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0x3, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_RESET_TIMEOUT={0xfffffffffffffe09, 0x4, 0x4}]}}]}, 0x38}}, 0x8000) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x70, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xf}, {}, {0x7, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x40, 0x2, [@TCA_FLOW_EMATCHES={0x3c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x7}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x2c, 0x1, 0x0, 0x0, {{0x8, 0x9, 0x40}, [@TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x1}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x3}, @TCA_EM_IPT_MATCH_DATA={0x4}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x2008c014) recvmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000180)=""/246, 0xf6}, {&(0x7f0000000080)=""/37, 0x25}], 0x2, &(0x7f00000004c0)=""/249, 0xf9}, 0x2100) writev(0xffffffffffffffff, 0x0, 0x0) close(0x3) 1.18705391s ago: executing program 2 (id=878): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-blowfish-asm\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) r6 = add_key$user(0x0, &(0x7f0000000440)={'syz', 0x1}, 0x0, 0x23, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, 0x0) socket$netlink(0x10, 0x3, 0x10) syz_open_dev$loop(0x0, 0x75f, 0xa382) mkdirat(0xffffffffffffffff, 0x0, 0xc0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYRESOCT=r5, @ANYRESHEX=r6]) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c800000000020104ba000000000000000a0000003c0001800c00028005000100210000002c000180140003000000000000000000000000000000000114639100fe8000000000000000000000000000bb3c0003800c00028005000100000000002c00018014000300fc00000000000000000000000000000014000400fe8000000000000000000000000000bb3c0002800c00028005000100000000002c00018014000300fc02000000000000000000000000000014000400"], 0xc8}}, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x4020aeb2, &(0x7f0000000300)={0x0, 0x12c, @ioapic={0xffff1000, 0x8000, 0x2, 0x80000001, 0x0, [{0x1, 0x85, 0x1, '\x00', 0x4}, {0x5, 0x3, 0x0, '\x00', 0x6}, {0x7, 0x3, 0xe, '\x00', 0x3b}, {0x4e, 0xe, 0xd6, '\x00', 0x86}, {0xc, 0xb, 0x6, '\x00', 0x4}, {0xf, 0x8, 0xf5, '\x00', 0x3}, {0x2, 0xa, 0x50, '\x00', 0x6}, {0x88, 0x3, 0x2a, '\x00', 0x80}, {0x4, 0x0, 0xa, '\x00', 0x1}, {0x8, 0x9, 0x3, '\x00', 0x8}, {0x3, 0x6, 0x3, '\x00', 0x6}, {0x2, 0x9, 0x0, '\x00', 0x7f}, {0x14, 0x51, 0xa, '\x00', 0xfc}, {0xe, 0xfc, 0x5, '\x00', 0x1}, {0x9, 0x2, 0x6, '\x00', 0x9}, {0x1, 0x3, 0xfe, '\x00', 0x3}, {0x2, 0xb, 0xd6, '\x00', 0x7f}, {0x7, 0x15, 0xca, '\x00', 0x6}, {0x0, 0x1, 0x4, '\x00', 0x13}, {0x4, 0x0, 0x40, '\x00', 0xda}, {0x3, 0x3, 0x6, '\x00', 0x9}, {0x9, 0x3, 0x1, '\x00', 0x2}, {0xf9, 0x1, 0x4, '\x00', 0x8}, {0x8, 0xc, 0x0, '\x00', 0x6}]}}) ioctl$KVM_SET_CPUID(r7, 0x4008ae8a, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ad060000", 0x4) sendmsg$alg(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000140)="439db5", 0x3}], 0x1, &(0x7f0000000540)=[@op={0x18}], 0x18}, 0x0) recvmmsg(r1, &(0x7f0000000dc0)=[{{0x0, 0x0, 0x0}, 0x14}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000005c0)=""/103, 0x67}], 0x1}, 0xe}], 0x2, 0x2021, 0x0) 1.065777949s ago: executing program 1 (id=879): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$I2C(&(0x7f0000000000), 0x1e, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[], 0x20}}, 0x24040800) r4 = syz_io_uring_setup(0x819, &(0x7f0000000180)={0x0, 0x69b5, 0x10100, 0xfffffffe}, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r7, &(0x7f0000000280)=ANY=[], 0x28) write$UHID_CREATE2(r7, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r7, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2002}) io_uring_enter(r4, 0x1c64, 0xfffffffe, 0x60, 0x0, 0x0) 1.048246628s ago: executing program 0 (id=880): r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000480)=@ethtool_ringparam={0x4, 0x0, 0x4, 0x8201, 0x0, 0x8000000, 0x2, 0x2fd, 0x100000}}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000007, 0x31, 0xffffffffffffffff, 0x0) 753.764973ms ago: executing program 4 (id=881): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r3, 0x325, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0xfffffffffffffe, &(0x7f0000006680)) syz_usbip_server_init(0x4) 626.192239ms ago: executing program 3 (id=882): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000000540)={&(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000940)=[@cswp={0x58, 0x114, 0x7, {{0x2, 0x7}, &(0x7f00000006c0)=0x7, &(0x7f0000000900)=0xb, 0x16, 0xfffffffffffffff7, 0x8, 0x5, 0x2, 0xb}}], 0x58}, 0x0) 492.063732ms ago: executing program 1 (id=883): pipe(&(0x7f0000000140)={0xffffffffffffffff}) close(0xffffffffffffffff) socket$inet(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="60000000020601020000000000000000000000000900020073797a31000000000500010007000000050005000a00000014000780080013400000040008001240fffffffa11"], 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x0) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x248040) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000300)={{0x3c, 0x55}, 'port1\x00', 0x11, 0x20000, 0xfffffff4, 0x457, 0x40, 0xb, 0x0, 0x0, 0x3, 0x71}) sendmmsg(r1, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x8, r4}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x1}], 0x1}}], 0x1, 0x0) 410.044735ms ago: executing program 0 (id=884): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0xfff6, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}}) 0s ago: executing program 1 (id=885): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = dup(r2) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f00000000c0)=ANY=[@ANYBLOB="820000000000029899000040"]) kernel console output (not intermixed with test programs): error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 190.609880][ T7313] batman_adv: batadv0: Not using interface vlan1 (retrying later): interface not active [ 191.007568][ T7331] netlink: 72 bytes leftover after parsing attributes in process `syz.3.442'. [ 191.030987][ T7331] tipc: Started in network mode [ 191.037660][ T7331] tipc: Node identity , cluster identity 4711 [ 191.044557][ T7331] tipc: Failed to obtain node identity [ 191.050322][ T7331] tipc: Enabling of bearer rejected, failed to enable media [ 191.226319][ T7334] IPv6: NLM_F_CREATE should be specified when creating new route [ 191.283671][ T6378] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 191.442851][ T6378] usb 3-1: Using ep0 maxpacket: 16 [ 191.469537][ T6378] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 191.497268][ T6378] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 191.540913][ T6378] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 191.556800][ T6378] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.568285][ T6378] usb 3-1: Product: syz [ 191.575284][ T6378] usb 3-1: Manufacturer: syz [ 191.580103][ T6378] usb 3-1: SerialNumber: syz [ 191.598876][ T6378] usb 3-1: config 0 descriptor?? [ 191.611725][ T6378] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 191.627878][ T6378] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 191.682834][ T6398] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 191.813306][ T7340] fuse: Bad value for 'fd' [ 191.892978][ T6398] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 196, using maximum allowed: 30 [ 191.904938][ T6398] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 191.915021][ T6398] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 196 [ 191.935950][ T6398] usb 2-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.00 [ 191.948391][ T6398] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.970888][ T6398] usb 2-1: config 0 descriptor?? [ 192.062759][ T6397] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 192.211069][ T6378] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 192.216693][ T6397] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 192.228931][ T6397] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 192.253528][ T6378] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 192.281288][ T6397] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 192.291306][ T6397] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 192.320253][ T6397] usb 5-1: SerialNumber: syz [ 192.390918][ T6398] holtek_kbd 0003:04D9:A055.0007: unknown main item tag 0x0 [ 192.399191][ T6398] holtek_kbd 0003:04D9:A055.0007: unknown main item tag 0x0 [ 192.434913][ T6398] holtek_kbd 0003:04D9:A055.0007: hidraw0: USB HID v10.00 Device [HID 04d9:a055] on usb-dummy_hcd.1-1/input0 [ 192.586855][ T6396] usb 2-1: USB disconnect, device number 22 [ 192.748848][ T7346] fido_id[7346]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 192.802874][ T6398] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 192.988314][ T6398] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 193.003122][ T6398] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 193.021913][ T6398] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 193.038297][ T6398] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 193.052167][ T7354] netlink: 'syz.0.452': attribute type 2 has an invalid length. [ 193.052992][ T51] Bluetooth: hci2: unexpected event 0x20 length: 19 > 7 [ 193.061009][ T6398] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 193.081288][ T7354] netlink: 'syz.0.452': attribute type 1 has an invalid length. [ 193.093329][ T6398] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 193.102547][ T6398] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 193.113644][ T6397] usb 5-1: skipping empty audio interface (v1) [ 193.124659][ T6398] usb 4-1: Product: syz [ 193.128902][ T6398] usb 4-1: Manufacturer: syz [ 193.147784][ T6398] usb 4-1: SerialNumber: syz [ 193.154493][ T6397] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 193.175898][ T6397] usb 5-1: USB disconnect, device number 20 [ 193.181975][ T6398] usb 4-1: config 0 descriptor?? [ 193.247473][ T5831] udevd[5831]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 193.295068][ T6378] em28xx 3-1:0.0: Unknown AC97 audio processor detected! [ 193.332882][ T6378] em28xx 3-1:0.0: couldn't setup AC97 register 2 [ 193.397155][ T6398] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 193.418710][ T7357] vxcan3: entered promiscuous mode [ 193.428178][ T6398] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 193.447217][ T7357] vxcan3: entered allmulticast mode [ 193.542569][ T7360] pim6reg: entered allmulticast mode [ 193.560633][ T7365] team0: entered promiscuous mode [ 193.565943][ T7365] bond0: entered promiscuous mode [ 193.578756][ T7365] batadv_slave_0: entered promiscuous mode [ 193.593691][ T7364] batadv_slave_0: left promiscuous mode [ 193.600127][ T6398] radio-si470x 4-1:0.0: software version 0, hardware version 0 [ 193.607809][ T6398] radio-si470x 4-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 193.620786][ T7364] team0: left promiscuous mode [ 193.626091][ T7364] bond0: left promiscuous mode [ 193.632750][ T6398] radio-si470x 4-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 193.800886][ T6398] radio-si470x 4-1:0.0: submitting int urb failed (-90) [ 193.972710][ T6378] em28xx 3-1:0.0: AC97 command still being executed: not handled properly! [ 194.009627][ T6378] em28xx 3-1:0.0: couldn't setup AC97 register 6 [ 194.146755][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.166367][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.179852][ T6378] em28xx 3-1:0.0: couldn't setup AC97 register 54 [ 194.197578][ T30] kauditd_printk_skb: 39 callbacks suppressed [ 194.197597][ T30] audit: type=1326 audit(1751209785.557:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.4.459" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4800d8e52b code=0x7ffc0000 [ 194.227318][ T6378] em28xx 3-1:0.0: couldn't setup AC97 register 56 [ 194.241715][ T6378] usb 3-1: USB disconnect, device number 21 [ 194.299250][ T30] audit: type=1326 audit(1751209785.657:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.4.459" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4800d8e52b code=0x7ffc0000 [ 194.337740][ T7383] fuse: Bad value for 'fd' [ 194.347070][ T7383] __nla_validate_parse: 8 callbacks suppressed [ 194.347087][ T7383] netlink: 44 bytes leftover after parsing attributes in process `syz.1.463'. [ 194.372936][ T5914] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 194.383137][ T5898] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 194.397595][ T30] audit: type=1326 audit(1751209785.757:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.4.459" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4800d8e52b code=0x7ffc0000 [ 194.421088][ T30] audit: type=1326 audit(1751209785.757:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.4.459" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4800d8e52b code=0x7ffc0000 [ 194.526110][ T30] audit: type=1326 audit(1751209785.757:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.4.459" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4800d8e52b code=0x7ffc0000 [ 194.571102][ T5898] usb 1-1: device descriptor read/64, error -71 [ 194.579512][ T30] audit: type=1326 audit(1751209785.937:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.4.459" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4800d8e52b code=0x7ffc0000 [ 194.632777][ T5912] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 194.652889][ T5914] usb 5-1: Using ep0 maxpacket: 16 [ 194.659190][ T30] audit: type=1326 audit(1751209786.017:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.4.459" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4800d8e52b code=0x7ffc0000 [ 194.688453][ T30] audit: type=1326 audit(1751209786.047:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.4.459" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4800d8e52b code=0x7ffc0000 [ 194.716035][ T30] audit: type=1326 audit(1751209786.047:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.4.459" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 194.739060][ T30] audit: type=1326 audit(1751209786.047:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.4.459" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 194.801671][ T5912] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 194.822821][ T5898] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 194.837286][ T5912] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 194.880213][ T5912] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 194.889888][ T5912] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 194.911449][ T5912] usb 2-1: SerialNumber: syz [ 194.975308][ T5898] usb 1-1: device descriptor read/64, error -71 [ 195.084202][ T5898] usb usb1-port1: attempt power cycle [ 195.252873][ T6400] usb 3-1: new low-speed USB device number 22 using dummy_hcd [ 195.408691][ T6400] usb 3-1: config 65 has an invalid interface number: 95 but max is 0 [ 195.424486][ T6400] usb 3-1: config 65 has no interface number 0 [ 195.437630][ T6400] usb 3-1: string descriptor 0 read error: -22 [ 195.444366][ T6400] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=6f.b6 [ 195.452938][ T5898] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 195.456985][ T6400] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.485212][ T5898] usb 1-1: device descriptor read/8, error -71 [ 195.494391][ T6400] usbtest 3-1:65.95: Linux gadget zero [ 195.512711][ T6400] usbtest 3-1:65.95: low-speed {control in/out} tests (+alt) [ 195.646131][ T5912] usb 2-1: skipping empty audio interface (v1) [ 195.646185][ T6400] usb 4-1: USB disconnect, device number 18 [ 195.726639][ T5912] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 195.782127][ T5898] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 195.805060][ T5912] usb 2-1: USB disconnect, device number 23 [ 195.836565][ T5898] usb 1-1: device descriptor read/8, error -71 [ 195.894761][ T5835] udevd[5835]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 195.911539][ T7397] netlink: 'syz.1.467': attribute type 1 has an invalid length. [ 195.911564][ T7397] netlink: 4 bytes leftover after parsing attributes in process `syz.1.467'. [ 195.969362][ T5898] usb usb1-port1: unable to enumerate USB device [ 196.201149][ T6400] usb 3-1: USB disconnect, device number 22 [ 196.262116][ T51] Bluetooth: hci3: unexpected event 0x20 length: 19 > 7 [ 196.268230][ T7401] netlink: 12 bytes leftover after parsing attributes in process `syz.3.470'. [ 196.289199][ T7401] netlink: 'syz.3.470': attribute type 2 has an invalid length. [ 196.323858][ T7401] netlink: 'syz.3.470': attribute type 1 has an invalid length. [ 196.352262][ T7401] netlink: 4 bytes leftover after parsing attributes in process `syz.3.470'. [ 196.461448][ T7411] tmpfs: Unknown parameter 'fd' [ 196.870520][ T7420] fuse: Bad value for 'fd' [ 196.889555][ T7420] netlink: 44 bytes leftover after parsing attributes in process `syz.3.477'. [ 196.957478][ T5914] usb 5-1: unable to get BOS descriptor or descriptor too short [ 196.997525][ T5914] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 197.013142][ T5914] usb 5-1: can't read configurations, error -71 [ 197.030762][ T7425] netlink: 40 bytes leftover after parsing attributes in process `syz.2.479'. [ 197.133619][ T6400] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 197.280771][ T7432] tipc: Enabling of bearer rejected, failed to enable media [ 197.314743][ T6400] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 197.322251][ T7434] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.483'. [ 197.335427][ T6400] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 197.375616][ T6400] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 197.412129][ T6400] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 197.441364][ T6400] usb 4-1: SerialNumber: syz [ 197.792766][ T5912] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 197.833548][ T5898] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 197.952848][ T5912] usb 1-1: Using ep0 maxpacket: 8 [ 197.965192][ T5912] usb 1-1: config 0 has an invalid interface number: 151 but max is 1 [ 197.987010][ T5912] usb 1-1: config 0 has no interface number 1 [ 198.000680][ T5912] usb 1-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 198.013652][ T5912] usb 1-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 198.027880][ T5912] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 198.040774][ T5912] usb 1-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 198.051939][ T5912] usb 1-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 198.066045][ T5898] usb 2-1: config 0 has no interfaces? [ 198.074003][ T5898] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 198.087059][ T5898] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.099607][ T5912] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 198.111557][ T5898] usb 2-1: Product: syz [ 198.119730][ T5898] usb 2-1: Manufacturer: syz [ 198.124652][ T5898] usb 2-1: SerialNumber: syz [ 198.131344][ T5912] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 198.144285][ T5898] usb 2-1: config 0 descriptor?? [ 198.155561][ T5912] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 198.172398][ T5912] usb 1-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 198.212853][ T5912] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.236889][ T6400] usb 4-1: skipping empty audio interface (v1) [ 198.238148][ T5912] usb 1-1: Product: syz [ 198.273667][ T5912] usb 1-1: Manufacturer: syz [ 198.283668][ T5912] usb 1-1: SerialNumber: syz [ 198.312082][ T5912] usb 1-1: config 0 descriptor?? [ 198.312129][ T6400] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 198.324725][ T7443] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 198.393688][ T5912] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 198.403184][ T6400] usb 4-1: USB disconnect, device number 19 [ 198.406030][ T5912] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 198.490021][ T5831] udevd[5831]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 198.605982][ T5912] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 198.644941][ T6398] usb 1-1: USB disconnect, device number 22 [ 198.684632][ T6397] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 198.804826][ T7466] udevd[7466]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 198.832969][ T6397] usb 5-1: Using ep0 maxpacket: 8 [ 198.835257][ T6397] usb 5-1: config 0 has too many interfaces: 190, using maximum allowed: 32 [ 198.835287][ T6397] usb 5-1: config 0 has an invalid interface number: 224 but max is 189 [ 198.835311][ T6397] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 190 [ 198.835335][ T6397] usb 5-1: config 0 has no interface number 0 [ 198.835420][ T6397] usb 5-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 198.835447][ T6397] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.840310][ T6397] usb 5-1: config 0 descriptor?? [ 199.043719][ T7461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 199.044204][ T7461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 199.056433][ T7461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 199.068373][ T7461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 199.069532][ T7473] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 199.070002][ T7473] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 199.072255][ T6397] usb 5-1: USB disconnect, device number 23 [ 200.132802][ T6376] usb 5-1: new low-speed USB device number 24 using dummy_hcd [ 200.259412][ T7487] fuse: Bad value for 'fd' [ 200.272145][ T7487] netlink: 44 bytes leftover after parsing attributes in process `syz.0.500'. [ 200.309466][ T6376] usb 5-1: string descriptor 0 read error: -22 [ 200.316287][ T6376] usb 5-1: New USB device found, idVendor=1415, idProduct=0003, bcdDevice=65.5d [ 200.325940][ T6376] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.355890][ T6376] usb 5-1: config 0 descriptor?? [ 200.494417][ T5912] usb 2-1: USB disconnect, device number 24 [ 200.522733][ T5898] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 200.554900][ T7498] netlink: 28 bytes leftover after parsing attributes in process `syz.3.505'. [ 200.603909][ T6376] dvb-usb: found a 'Sony PlayTV' in cold state, will try to load a firmware [ 200.660779][ T6376] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 200.671506][ T6376] dib0700: firmware download failed at 7 with -22 [ 200.684937][ T5898] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 200.714663][ T5898] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 200.726371][ T6376] usb 5-1: USB disconnect, device number 24 [ 200.749560][ T5898] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 200.769203][ T5898] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 200.784254][ T5898] usb 1-1: SerialNumber: syz [ 200.822430][ T7511] openvswitch: netlink: Multiple metadata blocks provided [ 201.102974][ T5912] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 201.411009][ T5912] usb 2-1: config 0 has no interfaces? [ 201.427786][ T5912] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 201.439653][ T5912] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.448230][ T5912] usb 2-1: Product: syz [ 201.453245][ T5912] usb 2-1: Manufacturer: syz [ 201.461247][ T5912] usb 2-1: SerialNumber: syz [ 201.476842][ T5912] usb 2-1: config 0 descriptor?? [ 201.609814][ T7519] netlink: 16 bytes leftover after parsing attributes in process `syz.2.511'. [ 201.625897][ T5898] usb 1-1: skipping empty audio interface (v1) [ 201.635401][ T5914] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 201.710752][ T5898] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 201.823507][ T5898] usb 1-1: USB disconnect, device number 23 [ 201.874518][ T5914] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 201.892867][ T5914] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 201.919797][ T5914] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 201.955489][ T5835] udevd[5835]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 201.976959][ T5914] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 201.992772][ T5914] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 202.025987][ T5914] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.054656][ T5914] usb 5-1: config 0 descriptor?? [ 202.482440][ T5914] plantronics 0003:047F:FFFF.0008: ignoring exceeding usage max [ 202.527548][ T5914] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 203.610096][ T7539] syz_tun: entered promiscuous mode [ 203.638766][ T7539] batadv_slave_0: entered promiscuous mode [ 203.660250][ T7539] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 203.669202][ T7539] Cannot create hsr debugfs directory [ 203.678103][ T7539] hsr1: Slave A (syz_tun) is not up; please bring it up to get a fully working HSR network [ 203.688804][ T7539] hsr1: Slave B (batadv_slave_0) is not up; please bring it up to get a fully working HSR network [ 203.933177][ T5898] usb 5-1: reset high-speed USB device number 25 using dummy_hcd [ 204.221287][ T5838] cgroup: fork rejected by pids controller in /syz0 [ 204.262192][ T6398] usb 2-1: USB disconnect, device number 25 [ 204.443310][ T5838] syz_tun (unregistering): left promiscuous mode [ 204.470078][ T7559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 204.500543][ T7559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 204.697813][ T6376] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 204.891846][ T6376] usb 3-1: unable to get BOS descriptor or descriptor too short [ 204.906638][ T6376] usb 3-1: not running at top speed; connect to a high speed hub [ 204.921043][ T7567] program syz.1.529 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 204.940692][ T6376] usb 3-1: config 0 has an invalid interface number: 88 but max is 0 [ 204.951185][ T6376] usb 3-1: config 0 has no interface number 0 [ 204.970170][ T6376] usb 3-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 10 [ 204.996501][ T6376] usb 3-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0 [ 205.017076][ T6376] usb 3-1: config 0 interface 88 has no altsetting 0 [ 205.100487][ T6376] usb 3-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 205.113952][ T6376] usb 3-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 205.125787][ T6376] usb 3-1: Product: syz [ 205.130011][ T6376] usb 3-1: Manufacturer: syz [ 205.139791][ T5914] usb 5-1: USB disconnect, device number 25 [ 205.146787][ T6376] usb 3-1: SerialNumber: syz [ 205.168983][ T6376] usb 3-1: config 0 descriptor?? [ 205.248084][ T7573] netlink: 'syz.3.531': attribute type 1 has an invalid length. [ 205.252963][ T7574] FAULT_INJECTION: forcing a failure. [ 205.252963][ T7574] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 205.256168][ T7573] netlink: 4 bytes leftover after parsing attributes in process `syz.3.531'. [ 205.295603][ T7574] CPU: 1 UID: 0 PID: 7574 Comm: syz.1.530 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 205.295638][ T7574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 205.295652][ T7574] Call Trace: [ 205.295661][ T7574] [ 205.295669][ T7574] dump_stack_lvl+0x189/0x250 [ 205.295709][ T7574] ? __pfx____ratelimit+0x10/0x10 [ 205.295740][ T7574] ? __pfx_dump_stack_lvl+0x10/0x10 [ 205.295772][ T7574] ? __pfx__printk+0x10/0x10 [ 205.295795][ T7574] ? __might_fault+0xb0/0x130 [ 205.295827][ T7574] should_fail_ex+0x414/0x560 [ 205.295858][ T7574] _copy_from_user+0x2d/0xb0 [ 205.295879][ T7574] snd_seq_oss_write+0x515/0x930 [ 205.295928][ T7574] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 205.295961][ T7574] ? common_file_perm+0x199/0x200 [ 205.295991][ T7574] ? security_file_permission+0x75/0x290 [ 205.296019][ T7574] odev_write+0x5a/0x80 [ 205.296042][ T7574] ? __pfx_odev_write+0x10/0x10 [ 205.296069][ T7574] vfs_write+0x27e/0xa90 [ 205.296111][ T7574] ? __pfx_vfs_write+0x10/0x10 [ 205.296152][ T7574] ? __fget_files+0x2a/0x420 [ 205.296178][ T7574] ? __fget_files+0x2a/0x420 [ 205.296201][ T7574] ? __fget_files+0x3a0/0x420 [ 205.296223][ T7574] ? __fget_files+0x2a/0x420 [ 205.296255][ T7574] ksys_write+0x145/0x250 [ 205.296278][ T7574] ? __pfx_ksys_write+0x10/0x10 [ 205.296302][ T7574] ? do_syscall_64+0xbe/0x3b0 [ 205.296338][ T7574] do_syscall_64+0xfa/0x3b0 [ 205.296380][ T7574] ? lockdep_hardirqs_on+0x9c/0x150 [ 205.296407][ T7574] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.296427][ T7574] ? clear_bhb_loop+0x60/0xb0 [ 205.296452][ T7574] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.296472][ T7574] RIP: 0033:0x7f24ee18e929 [ 205.296489][ T7574] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 205.296507][ T7574] RSP: 002b:00007f24ef06a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 205.296529][ T7574] RAX: ffffffffffffffda RBX: 00007f24ee3b6080 RCX: 00007f24ee18e929 [ 205.296544][ T7574] RDX: 0000000000000458 RSI: 00002000000008c0 RDI: 0000000000000003 [ 205.296558][ T7574] RBP: 00007f24ef06a090 R08: 0000000000000000 R09: 0000000000000000 [ 205.296570][ T7574] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 205.296582][ T7574] R13: 0000000000000001 R14: 00007f24ee3b6080 R15: 00007f24ee4dfa28 [ 205.296614][ T7574] [ 205.679613][ T6376] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.88/input/input15 [ 205.713823][ T6376] usb 3-1: USB disconnect, device number 23 [ 205.917543][ T5833] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 205.927986][ T5833] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 205.936251][ T5833] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 205.944812][ T5833] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 205.965394][ T5833] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 206.320443][ T7587] fuse: Bad value for 'fd' [ 206.563787][ T6398] usb 2-1: new low-speed USB device number 26 using dummy_hcd [ 206.731915][ T6398] usb 2-1: config 65 has an invalid interface number: 95 but max is 0 [ 206.742052][ T6398] usb 2-1: config 65 has no interface number 0 [ 206.757532][ T6398] usb 2-1: string descriptor 0 read error: -22 [ 206.767238][ T6398] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=6f.b6 [ 206.778382][ T6398] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.814253][ T6398] usbtest 2-1:65.95: Linux gadget zero [ 206.894179][ T6398] usbtest 2-1:65.95: low-speed {control in/out} tests (+alt) [ 206.946423][ T6376] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 207.247069][ T3025] team0: Port device bond0 removed [ 207.277576][ T3025] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 207.297166][ T6376] usb 5-1: no configurations [ 207.301838][ T6376] usb 5-1: can't read configurations, error -22 [ 207.323538][ T3025] bond0 (unregistering): Released all slaves [ 207.362975][ T7577] bridge3: entered promiscuous mode [ 207.401419][ T7577] bridge3: entered allmulticast mode [ 207.421150][ T7577] team0: Port device bridge3 added [ 207.443102][ T6376] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 207.601637][ T5898] usb 2-1: USB disconnect, device number 26 [ 207.617775][ T6376] usb 5-1: no configurations [ 207.622582][ T6376] usb 5-1: can't read configurations, error -22 [ 207.632961][ T6376] usb usb5-port1: attempt power cycle [ 207.694757][ T5833] Bluetooth: hci3: unexpected event 0x20 length: 19 > 7 [ 207.718201][ T7609] netlink: 12 bytes leftover after parsing attributes in process `syz.3.542'. [ 207.776696][ T3025] tipc: Disabling bearer [ 207.815946][ T7609] netlink: 'syz.3.542': attribute type 2 has an invalid length. [ 207.830873][ T3025] tipc: Left network mode [ 207.859081][ T7609] netlink: 'syz.3.542': attribute type 1 has an invalid length. [ 207.904148][ T7609] netlink: 4 bytes leftover after parsing attributes in process `syz.3.542'. [ 208.022795][ T6376] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 208.104508][ T5833] Bluetooth: hci2: command tx timeout [ 208.140757][ T6376] usb 5-1: no configurations [ 208.149799][ T6376] usb 5-1: can't read configurations, error -22 [ 208.442757][ T6376] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 208.559016][ T6376] usb 5-1: no configurations [ 208.569015][ T6376] usb 5-1: can't read configurations, error -22 [ 208.594781][ T6376] usb usb5-port1: unable to enumerate USB device [ 209.085983][ T7631] sctp: [Deprecated]: syz.1.544 (pid 7631) Use of int in maxseg socket option. [ 209.085983][ T7631] Use struct sctp_assoc_value instead [ 209.107064][ T7631] netlink: 'syz.1.544': attribute type 10 has an invalid length. [ 209.317716][ T7580] chnl_net:caif_netlink_parms(): no params data found [ 210.016865][ T3025] batadv_slave_0: left promiscuous mode [ 210.153948][ T7635] Bluetooth: hci2: command tx timeout [ 210.188190][ T3025] hsr_slave_0: left promiscuous mode [ 210.280277][ T3025] hsr_slave_1: left promiscuous mode [ 210.395925][ T3025] batman_adv: batadv0: Removing interface: vlan1 [ 210.857582][ T7649] netlink: 12 bytes leftover after parsing attributes in process `syz.3.549'. [ 211.743191][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 211.762791][ T5898] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 211.785539][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 211.792448][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 211.792534][ T5833] Bluetooth: hci4: command 0x0406 tx timeout [ 211.975571][ T5898] usb 5-1: config 0 has no interfaces? [ 212.010487][ T5898] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 212.023056][ T5898] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.038844][ T5898] usb 5-1: Product: syz [ 212.050728][ T5898] usb 5-1: Manufacturer: syz [ 212.059301][ T5898] usb 5-1: SerialNumber: syz [ 212.222967][ T5833] Bluetooth: hci2: command tx timeout [ 212.244440][ T5898] usb 5-1: config 0 descriptor?? [ 213.061719][ T7649] mac80211_hwsim hwsim7 wlan0: entered promiscuous mode [ 213.077465][ T7649] macsec1: entered promiscuous mode [ 213.084385][ T7649] macsec1: entered allmulticast mode [ 213.089876][ T7649] mac80211_hwsim hwsim7 wlan0: entered allmulticast mode [ 213.188177][ T7660] kthread_run failed with err -4 [ 213.434158][ T7673] fuse: Bad value for 'fd' [ 213.445418][ T7580] bridge0: port 1(bridge_slave_0) entered blocking state [ 213.476361][ T7580] bridge0: port 1(bridge_slave_0) entered disabled state [ 213.499462][ T7580] bridge_slave_0: entered allmulticast mode [ 213.510842][ T7580] bridge_slave_0: entered promiscuous mode [ 213.533201][ T7580] bridge0: port 2(bridge_slave_1) entered blocking state [ 213.574923][ T7580] bridge0: port 2(bridge_slave_1) entered disabled state [ 213.586534][ T6398] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 213.604188][ T7580] bridge_slave_1: entered allmulticast mode [ 213.622062][ T7580] bridge_slave_1: entered promiscuous mode [ 213.692828][ T6400] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 213.727122][ T7580] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 213.760558][ T7580] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 213.775269][ T6398] usb 4-1: Using ep0 maxpacket: 8 [ 213.803452][ T6398] usb 4-1: too many configurations: 232, using maximum allowed: 8 [ 213.827890][ T6398] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 213.867509][ T6400] usb 2-1: Using ep0 maxpacket: 16 [ 213.884302][ T6398] usb 4-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 213.897848][ T6400] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 213.908889][ T6400] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 213.923615][ T6400] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 213.932714][ T6398] usb 4-1: config 1 interface 0 has no altsetting 0 [ 213.942140][ T6398] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 213.960956][ T6400] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 213.970356][ T6400] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.988410][ T6398] usb 4-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 214.016097][ T6400] usb 2-1: Product: syz [ 214.023353][ T6400] usb 2-1: Manufacturer: syz [ 214.035582][ T7580] team0: Port device team_slave_0 added [ 214.041370][ T6398] usb 4-1: config 1 interface 0 has no altsetting 0 [ 214.048131][ T6400] usb 2-1: SerialNumber: syz [ 214.062214][ T6398] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.090447][ T7580] team0: Port device team_slave_1 added [ 214.107704][ T6398] usb 4-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 214.158747][ T6398] usb 4-1: config 1 interface 0 has no altsetting 0 [ 214.200647][ T6398] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.222885][ T6398] usb 4-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 214.236258][ T6398] usb 4-1: config 1 interface 0 has no altsetting 0 [ 214.244420][ T6398] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.255634][ T6398] usb 4-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 214.282088][ T7580] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 214.306923][ T5833] Bluetooth: hci2: command tx timeout [ 214.310692][ T7580] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 214.352711][ T6398] usb 4-1: config 1 interface 0 has no altsetting 0 [ 214.380817][ T6398] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.401668][ T6398] usb 4-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 214.501191][ T6392] usb 5-1: USB disconnect, device number 30 [ 214.512862][ T6400] usb 2-1: 0:2 : does not exist [ 214.522874][ T7580] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 214.537564][ T7580] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 214.550931][ T7580] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 214.557161][ T6398] usb 4-1: config 1 interface 0 has no altsetting 0 [ 214.579206][ T7580] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 214.669914][ T6398] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.680666][ T6398] usb 4-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 214.696569][ T6398] usb 4-1: config 1 interface 0 has no altsetting 0 [ 214.715566][ T6398] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.732445][ T6398] usb 4-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 214.753905][ T6398] usb 4-1: config 1 interface 0 has no altsetting 0 [ 214.773936][ T6398] usb 4-1: New USB device found, idVendor=05ac, idProduct=024e, bcdDevice= 0.40 [ 214.783981][ T6398] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.792087][ T6398] usb 4-1: Product: syz [ 214.796957][ T6398] usb 4-1: Manufacturer: syz [ 214.801628][ T6398] usb 4-1: SerialNumber: syz [ 214.850665][ T6398] usbhid 4-1:1.0: couldn't find an input interrupt endpoint [ 214.961325][ T7580] hsr_slave_0: entered promiscuous mode [ 214.970527][ T7580] hsr_slave_1: entered promiscuous mode [ 214.995284][ T7580] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 215.008922][ T7580] Cannot create hsr debugfs directory [ 215.592775][ T6376] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 216.170106][ T6376] usb 5-1: no configurations [ 216.174941][ T6376] usb 5-1: can't read configurations, error -22 [ 216.293068][ T5898] usb 4-1: USB disconnect, device number 20 [ 216.373135][ T6376] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 216.465896][ T6400] usb 2-1: 1:0: failed to get current value for ch 0 (-22) [ 216.499125][ T7703] loop6: detected capacity change from 0 to 7 [ 216.527176][ T7467] Dev loop6: unable to read RDB block 7 [ 216.559296][ T7467] loop6: unable to read partition table [ 216.572111][ T6400] usb 2-1: USB disconnect, device number 27 [ 216.584638][ T7467] loop6: partition table beyond EOD, truncated [ 216.595128][ T6376] usb 5-1: no configurations [ 216.613646][ T6376] usb 5-1: can't read configurations, error -22 [ 216.663525][ T5835] udevd[5835]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 216.726907][ T6376] usb usb5-port1: attempt power cycle [ 216.802252][ T7703] Dev loop6: unable to read RDB block 7 [ 216.808238][ T7703] loop6: unable to read partition table [ 216.850209][ T7703] loop6: partition table beyond EOD, truncated [ 216.887329][ T7703] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 217.132681][ T6376] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 217.201102][ T6376] usb 5-1: no configurations [ 217.209830][ T6376] usb 5-1: can't read configurations, error -22 [ 217.251420][ T7717] FAULT_INJECTION: forcing a failure. [ 217.251420][ T7717] name failslab, interval 1, probability 0, space 0, times 0 [ 217.292895][ T7717] CPU: 1 UID: 0 PID: 7717 Comm: syz.3.566 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 217.292928][ T7717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 217.292938][ T7717] Call Trace: [ 217.292948][ T7717] [ 217.292955][ T7717] dump_stack_lvl+0x189/0x250 [ 217.292983][ T7717] ? __pfx____ratelimit+0x10/0x10 [ 217.293012][ T7717] ? __pfx_dump_stack_lvl+0x10/0x10 [ 217.293036][ T7717] ? __pfx__printk+0x10/0x10 [ 217.293057][ T7717] ? ref_tracker_alloc+0x318/0x460 [ 217.293079][ T7717] should_fail_ex+0x414/0x560 [ 217.293101][ T7717] should_failslab+0xa8/0x100 [ 217.293119][ T7717] kmem_cache_alloc_noprof+0x73/0x3c0 [ 217.293143][ T7717] ? skb_clone+0x212/0x3a0 [ 217.293165][ T7717] skb_clone+0x212/0x3a0 [ 217.293187][ T7717] __netlink_deliver_tap+0x404/0x850 [ 217.293213][ T7717] ? netlink_deliver_tap+0x2e/0x1b0 [ 217.293231][ T7717] netlink_deliver_tap+0x19c/0x1b0 [ 217.293248][ T7717] netlink_unicast+0x72f/0x8d0 [ 217.293271][ T7717] netlink_sendmsg+0x805/0xb30 [ 217.293295][ T7717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 217.293315][ T7717] ? aa_sock_msg_perm+0x94/0x160 [ 217.293335][ T7717] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 217.293354][ T7717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 217.293372][ T7717] __sock_sendmsg+0x219/0x270 [ 217.293397][ T7717] sock_sendmsg+0x158/0x230 [ 217.293421][ T7717] ? __pfx_sock_sendmsg+0x10/0x10 [ 217.293453][ T7717] ? __asan_memset+0x22/0x50 [ 217.293473][ T7717] ? iov_iter_bvec+0xb8/0x180 [ 217.293497][ T7717] splice_to_socket+0x8ff/0xf10 [ 217.293530][ T7717] ? __pfx_splice_to_socket+0x10/0x10 [ 217.293543][ T7717] ? aa_file_perm+0x3e7/0xed0 [ 217.293582][ T7717] ? get_pid_task+0x20/0x1f0 [ 217.293610][ T7717] ? bpf_lsm_file_permission+0x9/0x20 [ 217.293631][ T7717] ? security_file_permission+0x75/0x290 [ 217.293647][ T7717] ? rw_verify_area+0x258/0x650 [ 217.293683][ T7717] ? __pfx_splice_to_socket+0x10/0x10 [ 217.293697][ T7717] do_splice+0xc76/0x1660 [ 217.293731][ T7717] ? __pfx_do_splice+0x10/0x10 [ 217.293754][ T7717] __se_sys_splice+0x2e1/0x460 [ 217.293774][ T7717] ? __pfx___se_sys_splice+0x10/0x10 [ 217.293794][ T7717] ? __x64_sys_splice+0x21/0xf0 [ 217.293812][ T7717] do_syscall_64+0xfa/0x3b0 [ 217.293833][ T7717] ? lockdep_hardirqs_on+0x9c/0x150 [ 217.293853][ T7717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.293867][ T7717] ? clear_bhb_loop+0x60/0xb0 [ 217.293884][ T7717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.293898][ T7717] RIP: 0033:0x7f3c8f38e929 [ 217.293911][ T7717] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 217.293924][ T7717] RSP: 002b:00007f3c902bf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 217.293940][ T7717] RAX: ffffffffffffffda RBX: 00007f3c8f5b6080 RCX: 00007f3c8f38e929 [ 217.293951][ T7717] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 217.293959][ T7717] RBP: 00007f3c902bf090 R08: 000000000004ffe2 R09: 0000000000000000 [ 217.293969][ T7717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 217.293977][ T7717] R13: 0000000000000001 R14: 00007f3c8f5b6080 R15: 00007f3c8f6dfa28 [ 217.294004][ T7717] [ 217.295306][ T7717] netlink: 2052 bytes leftover after parsing attributes in process `syz.3.566'. [ 217.628341][ T6376] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 217.692143][ T6376] usb 5-1: no configurations [ 217.699483][ T6376] usb 5-1: can't read configurations, error -22 [ 217.713286][ T6376] usb usb5-port1: unable to enumerate USB device [ 217.734475][ T7717] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 218.296674][ T7733] xt_hashlimit: max too large, truncated to 1048576 [ 218.351313][ T7580] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 218.434250][ T7580] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 218.599559][ T7580] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 218.613064][ T6400] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 218.656880][ T7580] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 218.793222][ T6376] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 218.833012][ T5912] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 218.839695][ T6400] usb 3-1: config 0 has no interfaces? [ 218.851665][ T6400] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 218.866820][ T6400] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.876305][ T6400] usb 3-1: Product: syz [ 218.882906][ T6400] usb 3-1: Manufacturer: syz [ 218.899935][ T6400] usb 3-1: SerialNumber: syz [ 218.926016][ T6400] usb 3-1: config 0 descriptor?? [ 218.972729][ T5912] usb 2-1: device descriptor read/64, error -71 [ 219.000230][ T6376] usb 5-1: config 0 has no interfaces? [ 219.033903][ T6376] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 219.095705][ T6376] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.114860][ T7759] x_tables: duplicate underflow at hook 2 [ 219.124496][ T6376] usb 5-1: Product: syz [ 219.128739][ T6376] usb 5-1: Manufacturer: syz [ 219.166073][ T7759] IPVS: set_ctl: invalid protocol: 41 100.1.1.0:20004 [ 219.181976][ T6376] usb 5-1: SerialNumber: syz [ 219.222855][ T5912] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 219.235986][ T6376] usb 5-1: config 0 descriptor?? [ 219.266314][ T7580] 8021q: adding VLAN 0 to HW filter on device bond0 [ 219.362756][ T5912] usb 2-1: device descriptor read/64, error -71 [ 219.384108][ T7580] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.454986][ T2998] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.463301][ T2998] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.481237][ T7739] netlink: 20 bytes leftover after parsing attributes in process `syz.4.572'. [ 219.503487][ T5912] usb usb2-port1: attempt power cycle [ 219.504592][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.516279][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.659356][ T6376] usb 5-1: USB disconnect, device number 35 [ 219.873827][ T5912] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 219.911023][ T5912] usb 2-1: device descriptor read/8, error -71 [ 220.016789][ T7580] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 220.192851][ T5912] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 220.208192][ T7580] veth0_vlan: entered promiscuous mode [ 220.234835][ T5912] usb 2-1: device descriptor read/8, error -71 [ 220.273035][ T7580] veth1_vlan: entered promiscuous mode [ 220.364896][ T5912] usb usb2-port1: unable to enumerate USB device [ 220.491469][ T7580] veth0_macvtap: entered promiscuous mode [ 220.521495][ T7580] veth1_macvtap: entered promiscuous mode [ 220.626606][ T7785] sit0: entered promiscuous mode [ 220.665024][ T7785] netlink: 'syz.4.580': attribute type 1 has an invalid length. [ 220.704027][ T7785] netlink: 1 bytes leftover after parsing attributes in process `syz.4.580'. [ 220.769216][ T7580] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 220.890009][ T7580] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 220.950435][ T7580] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.972434][ T7580] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.993897][ T7580] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.022316][ T7580] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.043455][ T5898] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 221.273817][ T5898] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 221.386018][ T5898] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 221.389004][ T6398] usb 3-1: USB disconnect, device number 24 [ 221.431773][ T5898] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 221.448015][ T5898] usb 4-1: config 1 has no interface number 0 [ 221.532825][ T6378] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 221.547515][ T5898] usb 4-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 221.571960][ T7800] input: syz0 as /devices/virtual/input/input17 [ 221.578655][ T3025] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 221.613635][ T3025] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 221.640520][ T5898] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 221.641890][ T7800] input: failed to attach handler leds to device input17, error: -6 [ 221.674843][ T7803] FAULT_INJECTION: forcing a failure. [ 221.674843][ T7803] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 221.721635][ T7803] CPU: 0 UID: 0 PID: 7803 Comm: syz.1.584 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 221.721664][ T7803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 221.721677][ T7803] Call Trace: [ 221.721685][ T7803] [ 221.721693][ T7803] dump_stack_lvl+0x189/0x250 [ 221.721730][ T7803] ? __pfx____ratelimit+0x10/0x10 [ 221.721760][ T7803] ? __pfx_dump_stack_lvl+0x10/0x10 [ 221.721790][ T7803] ? __pfx__printk+0x10/0x10 [ 221.721812][ T7803] ? __might_fault+0xb0/0x130 [ 221.721841][ T7803] should_fail_ex+0x414/0x560 [ 221.721871][ T7803] _copy_from_user+0x2d/0xb0 [ 221.721898][ T7803] ___sys_recvmsg+0x12e/0x510 [ 221.721929][ T7803] ? __pfx____sys_recvmsg+0x10/0x10 [ 221.721985][ T7803] ? __might_fault+0xb0/0x130 [ 221.722008][ T7803] do_recvmmsg+0x307/0x770 [ 221.722041][ T7803] ? __pfx_do_recvmmsg+0x10/0x10 [ 221.722082][ T7803] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 221.722131][ T7803] __x64_sys_recvmmsg+0x190/0x240 [ 221.722159][ T7803] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 221.722181][ T7803] ? rcu_is_watching+0x15/0xb0 [ 221.722217][ T7803] ? do_syscall_64+0xbe/0x3b0 [ 221.722250][ T7803] do_syscall_64+0xfa/0x3b0 [ 221.722312][ T7803] ? lockdep_hardirqs_on+0x9c/0x150 [ 221.722341][ T7803] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.722361][ T7803] ? clear_bhb_loop+0x60/0xb0 [ 221.722386][ T7803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.722405][ T7803] RIP: 0033:0x7f24ee18e929 [ 221.722424][ T7803] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 221.722441][ T7803] RSP: 002b:00007f24ef08b038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 221.722464][ T7803] RAX: ffffffffffffffda RBX: 00007f24ee3b5fa0 RCX: 00007f24ee18e929 [ 221.722478][ T7803] RDX: 0000000000000600 RSI: 0000200000003700 RDI: 0000000000000004 [ 221.722491][ T7803] RBP: 00007f24ef08b090 R08: 0000000000000000 R09: 0000000000000000 [ 221.722504][ T7803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 221.722516][ T7803] R13: 0000000000000000 R14: 00007f24ee3b5fa0 R15: 00007f24ee4dfa28 [ 221.722555][ T7803] [ 221.951591][ T6378] usb 5-1: no configurations [ 222.016673][ T6378] usb 5-1: can't read configurations, error -22 [ 222.071458][ T5898] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 222.136265][ T5898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.207884][ T5898] usb 4-1: Product: syz [ 222.226656][ T5898] usb 4-1: Manufacturer: syz [ 222.231926][ T5898] usb 4-1: SerialNumber: syz [ 222.233948][ T2998] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 222.245125][ T6398] usb 3-1: new low-speed USB device number 25 using dummy_hcd [ 222.253129][ T6378] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 222.278079][ T2998] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 222.309992][ T5898] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 222.329566][ T5898] cdc_ncm 4-1:1.1: bind() failure [ 222.443408][ T6398] usb 3-1: Invalid ep0 maxpacket: 16 [ 222.452772][ T6378] usb 5-1: no configurations [ 222.457459][ T6378] usb 5-1: can't read configurations, error -22 [ 222.475764][ T6378] usb usb5-port1: attempt power cycle [ 222.516520][ T5898] usb 4-1: USB disconnect, device number 21 [ 222.703430][ T6398] usb 3-1: new low-speed USB device number 26 using dummy_hcd [ 222.893617][ T6378] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 222.913473][ T6398] usb 3-1: Invalid ep0 maxpacket: 16 [ 222.926864][ T6398] usb usb3-port1: attempt power cycle [ 222.938039][ T6378] usb 5-1: no configurations [ 222.944981][ T6378] usb 5-1: can't read configurations, error -22 [ 222.972848][ T6400] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 223.086049][ T6378] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 223.134291][ T6378] usb 5-1: no configurations [ 223.134317][ T6378] usb 5-1: can't read configurations, error -22 [ 223.134772][ T6378] usb usb5-port1: unable to enumerate USB device [ 223.136342][ T6400] usb 1-1: Using ep0 maxpacket: 8 [ 223.180290][ T6400] usb 1-1: unable to get BOS descriptor or descriptor too short [ 223.241028][ T6400] usb 1-1: config 5 interface 0 has no altsetting 0 [ 223.245685][ T6400] usb 1-1: New USB device found, idVendor=0e41, idProduct=4159, bcdDevice=6b.5b [ 223.245723][ T6400] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 223.245746][ T6400] usb 1-1: Product: syz [ 223.245766][ T6400] usb 1-1: Manufacturer: syz [ 223.245783][ T6400] usb 1-1: SerialNumber: syz [ 223.312806][ T6398] usb 3-1: new low-speed USB device number 27 using dummy_hcd [ 223.348474][ T6398] usb 3-1: Invalid ep0 maxpacket: 16 [ 223.469037][ T7819] loop6: detected capacity change from 0 to 524287999 [ 223.485808][ T6398] usb 3-1: new low-speed USB device number 28 using dummy_hcd [ 223.524011][ T6398] usb 3-1: Invalid ep0 maxpacket: 16 [ 223.529887][ T6398] usb usb3-port1: unable to enumerate USB device [ 223.609478][ T7467] Buffer I/O error on dev loop6, logical block 65535999, async page read [ 224.063029][ T5898] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 224.226617][ T5898] usb 4-1: config 0 has no interfaces? [ 224.235378][ T5898] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 224.248089][ T5898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.276179][ T5898] usb 4-1: Product: syz [ 224.282805][ T5898] usb 4-1: Manufacturer: syz [ 224.287471][ T5898] usb 4-1: SerialNumber: syz [ 224.328333][ T5898] usb 4-1: config 0 descriptor?? [ 224.585412][ T7835] netlink: 20 bytes leftover after parsing attributes in process `syz.3.590'. [ 224.706121][ T5898] usb 4-1: USB disconnect, device number 22 [ 224.880452][ T7840] netlink: 28 bytes leftover after parsing attributes in process `syz.2.592'. [ 225.322914][ T6378] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 225.475413][ T6400] snd_usb_podhd 1-1:5.0: Line 6 POD HD500X found [ 225.499522][ T6378] usb 5-1: config 0 has no interfaces? [ 225.550051][ T6400] usb 1-1: selecting invalid altsetting 1 [ 225.553580][ T6378] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 225.597594][ T6400] snd_usb_podhd 1-1:5.0: set_interface failed [ 225.602782][ T6378] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.625436][ T5833] Bluetooth: hci0: unexpected event 0x20 length: 19 > 7 [ 225.628511][ T7851] netlink: 12 bytes leftover after parsing attributes in process `syz.1.596'. [ 225.651058][ T6400] snd_usb_podhd 1-1:5.0: Line 6 POD HD500X now disconnected [ 225.652438][ T6378] usb 5-1: Product: syz [ 225.733197][ T7851] netlink: 'syz.1.596': attribute type 2 has an invalid length. [ 225.749277][ T6378] usb 5-1: Manufacturer: syz [ 225.766665][ T6400] snd_usb_podhd 1-1:5.0: probe with driver snd_usb_podhd failed with error -22 [ 225.770122][ T6378] usb 5-1: SerialNumber: syz [ 225.800069][ T6378] usb 5-1: config 0 descriptor?? [ 225.812794][ T7851] netlink: 'syz.1.596': attribute type 1 has an invalid length. [ 226.067299][ T7851] netlink: 4 bytes leftover after parsing attributes in process `syz.1.596'. [ 226.077466][ T6400] usb 1-1: USB disconnect, device number 24 [ 226.341826][ T7864] netlink: 8 bytes leftover after parsing attributes in process `syz.3.597'. [ 226.993145][ T5898] usb 2-1: new full-speed USB device number 32 using dummy_hcd [ 227.036909][ T7870] FAULT_INJECTION: forcing a failure. [ 227.036909][ T7870] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 227.068622][ T7870] CPU: 1 UID: 0 PID: 7870 Comm: syz.0.600 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 227.068643][ T7870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 227.068652][ T7870] Call Trace: [ 227.068658][ T7870] [ 227.068664][ T7870] dump_stack_lvl+0x189/0x250 [ 227.068689][ T7870] ? __pfx____ratelimit+0x10/0x10 [ 227.068709][ T7870] ? __pfx_dump_stack_lvl+0x10/0x10 [ 227.068731][ T7870] ? __pfx__printk+0x10/0x10 [ 227.068746][ T7870] ? __might_fault+0xb0/0x130 [ 227.068768][ T7870] should_fail_ex+0x414/0x560 [ 227.068788][ T7870] _copy_from_user+0x2d/0xb0 [ 227.068801][ T7870] ___sys_recvmsg+0x12e/0x510 [ 227.068823][ T7870] ? __pfx____sys_recvmsg+0x10/0x10 [ 227.068859][ T7870] ? __might_fault+0xb0/0x130 [ 227.068874][ T7870] do_recvmmsg+0x307/0x770 [ 227.068897][ T7870] ? __pfx_do_recvmmsg+0x10/0x10 [ 227.068921][ T7870] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 227.068954][ T7870] __x64_sys_recvmmsg+0x190/0x240 [ 227.068973][ T7870] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 227.068989][ T7870] ? rcu_is_watching+0x15/0xb0 [ 227.069019][ T7870] ? do_syscall_64+0xbe/0x3b0 [ 227.069043][ T7870] do_syscall_64+0xfa/0x3b0 [ 227.069062][ T7870] ? lockdep_hardirqs_on+0x9c/0x150 [ 227.069081][ T7870] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 227.069094][ T7870] ? clear_bhb_loop+0x60/0xb0 [ 227.069110][ T7870] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 227.069123][ T7870] RIP: 0033:0x7ffa4e98e929 [ 227.069136][ T7870] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 227.069147][ T7870] RSP: 002b:00007ffa4f797038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 227.069161][ T7870] RAX: ffffffffffffffda RBX: 00007ffa4ebb5fa0 RCX: 00007ffa4e98e929 [ 227.069172][ T7870] RDX: 000000000000f000 RSI: 0000200000000d00 RDI: 0000000000000005 [ 227.069181][ T7870] RBP: 00007ffa4f797090 R08: 0000000000000000 R09: 0000000000000000 [ 227.069189][ T7870] R10: 0000000000010002 R11: 0000000000000246 R12: 0000000000000003 [ 227.069197][ T7870] R13: 0000000000000000 R14: 00007ffa4ebb5fa0 R15: 00007ffa4ecdfa28 [ 227.069217][ T7870] [ 227.572854][ T5898] usb 2-1: device descriptor read/64, error -71 [ 227.922976][ T5898] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 228.091173][ T5898] usb 2-1: device descriptor read/64, error -71 [ 228.162789][ T6400] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 228.193275][ T5912] usb 5-1: USB disconnect, device number 40 [ 228.220193][ T5898] usb usb2-port1: attempt power cycle [ 228.252804][ T6397] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 228.337138][ T7887] bridge1: entered promiscuous mode [ 228.343778][ T7887] bridge1: entered allmulticast mode [ 228.353224][ T6400] usb 1-1: Using ep0 maxpacket: 32 [ 228.366294][ T6400] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 228.374834][ T6400] usb 1-1: config 0 has no interface number 0 [ 228.387075][ T6400] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 228.402693][ T6400] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.417413][ T6397] usb 4-1: no configurations [ 228.422150][ T6397] usb 4-1: can't read configurations, error -22 [ 228.432144][ T6400] usb 1-1: Product: syz [ 228.443808][ T6400] usb 1-1: Manufacturer: syz [ 228.444019][ T7887] team0: Port device bridge1 added [ 228.448618][ T6400] usb 1-1: SerialNumber: syz [ 228.467482][ T6400] usb 1-1: config 0 descriptor?? [ 228.509199][ T6400] smsc95xx v2.0.0 [ 228.572830][ T6397] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 228.623135][ T5898] usb 2-1: new full-speed USB device number 34 using dummy_hcd [ 228.700622][ T5898] usb 2-1: device descriptor read/8, error -71 [ 228.806847][ T6397] usb 4-1: no configurations [ 228.811632][ T6397] usb 4-1: can't read configurations, error -22 [ 228.821868][ T6397] usb usb4-port1: attempt power cycle [ 228.915266][ T6400] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 228.929609][ T6400] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 228.969665][ T5898] usb 2-1: new full-speed USB device number 35 using dummy_hcd [ 228.983036][ T6392] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 229.019046][ T5898] usb 2-1: device descriptor read/8, error -71 [ 229.147137][ T6392] usb 5-1: config 0 has no interfaces? [ 229.158396][ T6392] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 229.172264][ T6392] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.181082][ T6397] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 229.191024][ T5898] usb usb2-port1: unable to enumerate USB device [ 229.197670][ T6392] usb 5-1: Product: syz [ 229.210885][ T6392] usb 5-1: Manufacturer: syz [ 229.218411][ T6392] usb 5-1: SerialNumber: syz [ 229.228582][ T6397] usb 4-1: no configurations [ 229.237703][ T6397] usb 4-1: can't read configurations, error -22 [ 229.276519][ T6392] usb 5-1: config 0 descriptor?? [ 229.422996][ T6397] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 229.458897][ T6397] usb 4-1: no configurations [ 229.465617][ T6397] usb 4-1: can't read configurations, error -22 [ 229.477759][ T6397] usb usb4-port1: unable to enumerate USB device [ 229.513744][ T7891] netlink: 20 bytes leftover after parsing attributes in process `syz.4.607'. [ 229.542825][ T6392] usb 5-1: USB disconnect, device number 41 [ 229.834287][ T7899] netlink: 'syz.1.610': attribute type 1 has an invalid length. [ 229.878650][ T7899] 8021q: adding VLAN 0 to HW filter on device bond2 [ 229.902329][ T7903] bond2: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 229.930864][ T7899] vlan2: entered allmulticast mode [ 229.941622][ T7899] bond2: entered allmulticast mode [ 229.948979][ T7899] bond2: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 231.203471][ T6400] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 231.254547][ T6400] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 231.359336][ T7927] fuse: Bad value for 'fd' [ 231.377735][ T6400] usb 1-1: USB disconnect, device number 25 [ 231.851832][ T7944] netlink: 4 bytes leftover after parsing attributes in process `syz.2.624'. [ 231.877127][ T7944] netlink: 4 bytes leftover after parsing attributes in process `syz.2.624'. [ 232.089366][ T7949] netlink: 36 bytes leftover after parsing attributes in process `syz.2.628'. [ 232.111519][ T7949] netlink: 16 bytes leftover after parsing attributes in process `syz.2.628'. [ 232.136576][ T7949] netlink: 36 bytes leftover after parsing attributes in process `syz.2.628'. [ 232.152489][ T7949] netlink: 36 bytes leftover after parsing attributes in process `syz.2.628'. [ 232.195173][ T7952] netlink: 4 bytes leftover after parsing attributes in process `syz.0.627'. [ 232.222746][ T7952] netlink: 4 bytes leftover after parsing attributes in process `syz.0.627'. [ 232.312727][ T6398] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 232.505281][ T7954] netlink: 72 bytes leftover after parsing attributes in process `syz.2.629'. [ 232.537892][ T7954] tipc: Started in network mode [ 232.562829][ T7954] tipc: Node identity , cluster identity 4711 [ 232.576825][ T6398] usb 2-1: config 0 has no interfaces? [ 232.592949][ T7954] tipc: Failed to obtain node identity [ 232.604130][ T6398] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 232.613963][ T7954] tipc: Enabling of bearer rejected, failed to enable media [ 232.622226][ T6398] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.669904][ T6398] usb 2-1: Product: syz [ 232.690828][ T6398] usb 2-1: Manufacturer: syz [ 232.717950][ T6398] usb 2-1: SerialNumber: syz [ 232.753537][ T6398] usb 2-1: config 0 descriptor?? [ 233.016706][ T7950] netlink: 20 bytes leftover after parsing attributes in process `syz.1.625'. [ 233.943516][ T7981] netlink: 'syz.4.639': attribute type 4 has an invalid length. [ 233.951587][ T5912] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 234.206842][ T5912] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 234.219642][ T5912] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 234.250006][ T5912] usb 3-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.00 [ 234.300509][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.362548][ T5912] usb 3-1: config 0 descriptor?? [ 234.993377][ T7974] macsec1: entered promiscuous mode [ 234.999016][ T7974] macsec1: entered allmulticast mode [ 235.011183][ T7974] ip6gretap0: entered allmulticast mode [ 235.155119][ T7974] ip6gretap0: left allmulticast mode [ 235.329813][ T5912] usbhid 3-1:0.0: can't add hid device: -71 [ 235.364081][ T5912] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 235.424176][ T5912] usb 3-1: USB disconnect, device number 29 [ 235.538765][ T6398] usb 2-1: USB disconnect, device number 36 [ 236.240358][ T8013] loop6: detected capacity change from 0 to 7 [ 236.294475][ T5835] Dev loop6: unable to read RDB block 7 [ 236.306923][ T5835] loop6: unable to read partition table [ 236.321847][ T5835] loop6: partition table beyond EOD, truncated [ 236.331409][ T8013] Dev loop6: unable to read RDB block 7 [ 236.347630][ T8013] loop6: unable to read partition table [ 236.357704][ T8013] loop6: partition table beyond EOD, truncated [ 236.375349][ T8013] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 236.572961][ T6400] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 236.754181][ T6400] usb 3-1: Using ep0 maxpacket: 8 [ 236.773544][ T6400] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 236.789933][ T6400] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.869979][ T6400] pvrusb2: Hardware description: Terratec Grabster AV400 [ 236.907470][ T6400] pvrusb2: ********** [ 236.940180][ T6400] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 236.992668][ T6400] pvrusb2: Important functionality might not be entirely working. [ 237.010843][ T6400] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 237.048464][ T6400] pvrusb2: ********** [ 237.154658][ T6392] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 237.154715][ T2340] pvrusb2: Invalid write control endpoint [ 237.292743][ T5898] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 237.348056][ T2340] pvrusb2: Invalid write control endpoint [ 237.377244][ T6392] usb 4-1: config 0 has no interfaces? [ 237.384903][ T6400] usb 3-1: USB disconnect, device number 30 [ 237.408306][ T6392] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 237.426452][ T2340] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 237.450332][ T6392] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.456931][ T2340] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 237.470666][ T6392] usb 4-1: Product: syz [ 237.480785][ T6392] usb 4-1: Manufacturer: syz [ 237.504958][ T5898] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 237.511270][ T6392] usb 4-1: SerialNumber: syz [ 237.525505][ T2340] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 237.542517][ T6392] usb 4-1: config 0 descriptor?? [ 237.553545][ T5898] usb 5-1: config 0 has no interfaces? [ 237.561899][ T2340] pvrusb2: Device being rendered inoperable [ 237.575318][ T5898] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 237.604897][ T2340] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 237.615982][ T5898] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 237.631291][ T2340] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 237.651108][ T5898] usb 5-1: SerialNumber: syz [ 237.684345][ T5898] usb 5-1: config 0 descriptor?? [ 237.702262][ T2340] pvrusb2: Attached sub-driver cx25840 [ 237.723795][ T2340] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 237.783545][ T8029] __nla_validate_parse: 3 callbacks suppressed [ 237.783567][ T8029] netlink: 20 bytes leftover after parsing attributes in process `syz.3.654'. [ 237.801937][ T2340] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 237.873968][ T6397] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 237.896383][ T5912] usb 5-1: USB disconnect, device number 42 [ 238.055361][ T6397] usb 2-1: Using ep0 maxpacket: 32 [ 238.071440][ T6397] usb 2-1: New USB device found, idVendor=0458, idProduct=7005, bcdDevice=1a.51 [ 238.102989][ T6397] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.125915][ T6397] usb 2-1: Product: syz [ 238.131424][ T6397] usb 2-1: Manufacturer: syz [ 238.140966][ T6397] usb 2-1: SerialNumber: syz [ 238.158006][ T6397] usb 2-1: config 0 descriptor?? [ 238.176711][ T6397] gspca_main: sn9c2028-2.14.0 probing 0458:7005 [ 238.372368][ T6397] gspca_sn9c2028: read1 error -71 [ 238.378244][ T6396] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 238.387698][ T6397] gspca_sn9c2028: read1 error -71 [ 238.393348][ T6397] gspca_sn9c2028: read1 error -71 [ 238.398750][ T6397] sn9c2028 2-1:0.0: probe with driver sn9c2028 failed with error -71 [ 238.412009][ T6397] usb 2-1: USB disconnect, device number 37 [ 238.507126][ T8049] netlink: 40 bytes leftover after parsing attributes in process `syz.4.663'. [ 238.525695][ T6396] usb 1-1: device descriptor read/64, error -71 [ 238.554740][ T5912] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 238.717441][ T5912] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 238.730019][ T5912] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 238.745832][ T5912] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 238.757849][ T5912] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.767609][ T5912] usb 3-1: Product: syz [ 238.771841][ T5912] usb 3-1: Manufacturer: syz [ 238.778442][ T5912] usb 3-1: SerialNumber: syz [ 238.793013][ T6396] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 238.854821][ C1] vcan0: j1939_tp_rxtimer: 0xffff888051e31000: rx timeout, send abort [ 238.936183][ T6396] usb 1-1: device descriptor read/64, error -71 [ 238.957578][ T5833] Bluetooth: hci0: unexpected event 0x20 length: 19 > 7 [ 238.961014][ T8053] netlink: 12 bytes leftover after parsing attributes in process `syz.1.665'. [ 238.977712][ T8053] netlink: 'syz.1.665': attribute type 2 has an invalid length. [ 238.987109][ T8053] netlink: 'syz.1.665': attribute type 1 has an invalid length. [ 238.996656][ T8053] netlink: 4 bytes leftover after parsing attributes in process `syz.1.665'. [ 239.073389][ T6396] usb usb1-port1: attempt power cycle [ 239.261932][ T8047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.281077][ T8047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.354981][ C1] vcan0: j1939_tp_rxtimer: 0xffff888051e30400: rx timeout, send abort [ 239.363372][ C1] vcan0: j1939_tp_rxtimer: 0xffff888051e31000: abort rx timeout. Force session deactivation [ 239.452864][ T6396] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 239.480392][ T8062] PKCS7: Unknown OID: [5] (bad) [ 239.488293][ T8062] PKCS7: Only support pkcs7_signedData type [ 239.532525][ T6396] usb 1-1: device descriptor read/8, error -71 [ 239.652382][ T8064] xt_hashlimit: max too large, truncated to 1048576 [ 239.847353][ T6396] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 239.856568][ T6378] usb 2-1: new low-speed USB device number 38 using dummy_hcd [ 239.864167][ C1] vcan0: j1939_tp_rxtimer: 0xffff888051e30400: abort rx timeout. Force session deactivation [ 239.872701][ T6392] usb 4-1: USB disconnect, device number 27 [ 239.922871][ T6396] usb 1-1: device descriptor read/8, error -71 [ 240.052964][ T5912] usb 3-1: 0:2 : does not exist [ 240.064182][ T6396] usb usb1-port1: unable to enumerate USB device [ 240.075601][ T5912] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 240.083177][ T6378] usb 2-1: device descriptor read/64, error -71 [ 240.199631][ T5912] usb 3-1: USB disconnect, device number 31 [ 240.279323][ T5835] udevd[5835]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 240.323015][ T6378] usb 2-1: new low-speed USB device number 39 using dummy_hcd [ 240.473014][ T6378] usb 2-1: device descriptor read/64, error -71 [ 240.572692][ T6376] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 240.583138][ T6378] usb usb2-port1: attempt power cycle [ 240.702782][ T6376] usb 4-1: device descriptor read/64, error -71 [ 240.715846][ T6392] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 240.915108][ T6392] usb 5-1: Using ep0 maxpacket: 16 [ 240.952873][ T6376] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 240.958258][ T6392] usb 5-1: config 0 has an invalid interface number: 213 but max is 0 [ 240.972767][ T6378] usb 2-1: new low-speed USB device number 40 using dummy_hcd [ 240.986443][ T6392] usb 5-1: config 0 has no interface number 0 [ 240.997196][ T6392] usb 5-1: config 0 interface 213 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 241.012056][ T6392] usb 5-1: config 0 interface 213 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 241.017220][ T6378] usb 2-1: device descriptor read/8, error -71 [ 241.030661][ T6392] usb 5-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 241.041592][ T6392] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.089704][ T6392] usb 5-1: config 0 descriptor?? [ 241.145527][ T6376] usb 4-1: device descriptor read/64, error -71 [ 241.292908][ T6378] usb 2-1: new low-speed USB device number 41 using dummy_hcd [ 241.312895][ T6376] usb usb4-port1: attempt power cycle [ 241.349159][ T6378] usb 2-1: device descriptor read/8, error -71 [ 241.417501][ T8087] netlink: 36 bytes leftover after parsing attributes in process `syz.2.675'. [ 241.429758][ T8087] netlink: 16 bytes leftover after parsing attributes in process `syz.2.675'. [ 241.440981][ T8087] netlink: 36 bytes leftover after parsing attributes in process `syz.2.675'. [ 241.454491][ T8087] netlink: 36 bytes leftover after parsing attributes in process `syz.2.675'. [ 241.465029][ T6378] usb usb2-port1: unable to enumerate USB device [ 241.571396][ T8091] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.587722][ T8091] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 241.704517][ T6376] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 241.733442][ T6376] usb 4-1: device descriptor read/8, error -71 [ 241.811346][ T8094] netlink: 8 bytes leftover after parsing attributes in process `syz.2.676'. [ 241.992747][ T6376] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 242.032209][ T6376] usb 4-1: device descriptor read/8, error -71 [ 242.167003][ T6376] usb usb4-port1: unable to enumerate USB device [ 242.452459][ T8096] netlink: 8 bytes leftover after parsing attributes in process `syz.0.677'. [ 242.543898][ T8096] ipvlan2: entered promiscuous mode [ 243.088015][ T8098] __nla_validate_parse: 1 callbacks suppressed [ 243.088036][ T8098] netlink: 24 bytes leftover after parsing attributes in process `syz.1.678'. [ 243.112786][ T6378] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 243.294281][ T6378] usb 1-1: config 0 has no interfaces? [ 243.362084][ T6378] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 243.462770][ T6378] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.483577][ T6378] usb 1-1: Product: syz [ 243.487816][ T6378] usb 1-1: Manufacturer: syz [ 243.492462][ T6378] usb 1-1: SerialNumber: syz [ 243.504480][ T6378] usb 1-1: config 0 descriptor?? [ 243.646545][ T6392] usbhid 5-1:0.213: can't add hid device: -71 [ 243.712759][ T6392] usbhid 5-1:0.213: probe with driver usbhid failed with error -71 [ 243.764026][ T6392] usb 5-1: USB disconnect, device number 43 [ 243.783085][ T8104] netlink: 20 bytes leftover after parsing attributes in process `syz.0.679'. [ 244.094233][ T8116] program syz.3.684 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 244.842816][ T6392] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 244.864152][ T6376] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 245.024856][ T6376] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 245.036428][ T6376] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 245.056238][ T6392] usb 4-1: Using ep0 maxpacket: 16 [ 245.068794][ T6376] usb 2-1: config 0 descriptor?? [ 245.080240][ T6392] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 245.101552][ T6376] cp210x 2-1:0.0: cp210x converter detected [ 245.135460][ T6392] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 245.157805][ T6392] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 245.172552][ T6392] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 245.193867][ T6392] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 245.217461][ T6392] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 245.235252][ T6392] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 245.245554][ T6392] usb 4-1: SerialNumber: syz [ 245.269748][ T8132] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 245.302955][ T6376] cp210x 2-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 245.306574][ T6392] cdc_acm 4-1:1.0: Control and data interfaces are not separated! [ 245.324880][ T6376] cp210x 2-1:0.0: querying part number failed [ 245.352338][ T6376] usb 2-1: cp210x converter now attached to ttyUSB0 [ 245.370308][ T6392] cdc_acm 4-1:1.0: probe with driver cdc_acm failed with error -12 [ 245.474461][ T6376] usb 2-1: USB disconnect, device number 42 [ 245.548765][ T6376] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 245.611096][ T6376] cp210x 2-1:0.0: device disconnected [ 245.781228][ T8150] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 245.810908][ T8150] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 246.071303][ T6378] usb 1-1: USB disconnect, device number 30 [ 246.422944][ T6392] usb 3-1: new low-speed USB device number 32 using dummy_hcd [ 246.549727][ T6376] usb 4-1: USB disconnect, device number 32 [ 246.554540][ T8170] netlink: 36 bytes leftover after parsing attributes in process `syz.4.699'. [ 246.603739][ T6392] usb 3-1: device descriptor read/64, error -71 [ 246.627847][ T8173] netlink: 36 bytes leftover after parsing attributes in process `syz.4.699'. [ 246.847535][ T8178] netlink: 4 bytes leftover after parsing attributes in process `syz.4.702'. [ 246.869486][ T6392] usb 3-1: new low-speed USB device number 33 using dummy_hcd [ 246.902577][ T8178] macvtap1: entered promiscuous mode [ 246.914371][ T8178] macvtap1: entered allmulticast mode [ 246.922397][ T8178] team0: entered allmulticast mode [ 246.932115][ T8178] bond0: entered allmulticast mode [ 246.939561][ T8178] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 247.002746][ T6392] usb 3-1: device descriptor read/64, error -71 [ 247.113657][ T6392] usb usb3-port1: attempt power cycle [ 247.345013][ T6397] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 247.453912][ T6392] usb 3-1: new low-speed USB device number 34 using dummy_hcd [ 247.483733][ T6392] usb 3-1: device descriptor read/8, error -71 [ 247.514550][ T6397] usb 5-1: config 9 has an invalid interface number: 32 but max is 0 [ 247.523086][ T6397] usb 5-1: config 9 has no interface number 0 [ 247.545559][ T6397] usb 5-1: config 9 interface 32 altsetting 9 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 247.563279][ T8190] netlink: 40 bytes leftover after parsing attributes in process `syz.3.705'. [ 247.593809][ T6397] usb 5-1: config 9 interface 32 has no altsetting 0 [ 247.619565][ T6397] usb 5-1: New USB device found, idVendor=0421, idProduct=01d0, bcdDevice=44.b3 [ 247.652428][ T6397] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.682196][ T6397] usb 5-1: Product: syz [ 247.697605][ T6397] usb 5-1: Manufacturer: syz [ 247.702340][ T6397] usb 5-1: SerialNumber: syz [ 247.732742][ T6392] usb 3-1: new low-speed USB device number 35 using dummy_hcd [ 247.773509][ T6392] usb 3-1: device descriptor read/8, error -71 [ 247.898467][ T6392] usb usb3-port1: unable to enumerate USB device [ 247.995459][ T8197] bridge4: entered promiscuous mode [ 248.001057][ T8197] bridge4: entered allmulticast mode [ 248.035935][ T8197] team0: Port device bridge4 added [ 248.043404][ T6397] usb 5-1: USB disconnect, device number 44 [ 248.482705][ T6392] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 248.572961][ T8215] Cannot find add_set index 0 as target [ 248.666962][ T6392] usb 2-1: config 0 has no interfaces? [ 248.687766][ T6392] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 248.708513][ T6392] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.726575][ T6392] usb 2-1: Product: syz [ 248.735994][ T6392] usb 2-1: Manufacturer: syz [ 248.740735][ T6392] usb 2-1: SerialNumber: syz [ 248.752349][ T6392] usb 2-1: config 0 descriptor?? [ 248.756578][ T8220] team_slave_0: entered promiscuous mode [ 248.763461][ T8220] team_slave_1: entered promiscuous mode [ 248.776479][ T8220] vlan2: entered promiscuous mode [ 248.781668][ T8220] team0: entered promiscuous mode [ 248.983608][ T8205] netlink: 20 bytes leftover after parsing attributes in process `syz.1.709'. [ 249.032964][ C0] vcan0: j1939_tp_rxtimer: 0xffff888052e43000: rx timeout, send abort [ 249.356553][ T8230] netlink: 'syz.0.720': attribute type 10 has an invalid length. [ 249.376469][ T8230] netlink: 40 bytes leftover after parsing attributes in process `syz.0.720'. [ 249.421563][ T8230] batman_adv: batadv0: Adding interface: vlan1 [ 249.450520][ T8230] batman_adv: batadv0: The MTU of interface vlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 249.534436][ C0] vcan0: j1939_tp_rxtimer: 0xffff888052e42c00: rx timeout, send abort [ 249.537666][ T8230] batman_adv: batadv0: Interface activated: vlan1 [ 249.545647][ C0] vcan0: j1939_tp_rxtimer: 0xffff888052e43000: abort rx timeout. Force session deactivation [ 249.597609][ T8234] netlink: 52 bytes leftover after parsing attributes in process `syz.2.721'. [ 250.033419][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 250.033437][ T30] audit: type=1326 audit(1751209841.397:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8243 comm="syz.4.725" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 250.061940][ C0] vcan0: j1939_tp_rxtimer: 0xffff888052e42c00: abort rx timeout. Force session deactivation [ 250.107798][ T8244] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 250.137620][ T8249] netlink: 36 bytes leftover after parsing attributes in process `syz.0.726'. [ 250.167551][ T8249] netlink: 16 bytes leftover after parsing attributes in process `syz.0.726'. [ 250.183304][ T8253] netlink: 8 bytes leftover after parsing attributes in process `syz.2.727'. [ 250.205667][ T30] audit: type=1326 audit(1751209841.437:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8243 comm="syz.4.725" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 250.253791][ T8249] netlink: 36 bytes leftover after parsing attributes in process `syz.0.726'. [ 250.302122][ T8249] netlink: 36 bytes leftover after parsing attributes in process `syz.0.726'. [ 250.318626][ T30] audit: type=1326 audit(1751209841.447:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8243 comm="syz.4.725" exe="/root/syz-executor" sig=0 arch=c000003e syscall=243 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 250.388655][ T30] audit: type=1326 audit(1751209841.447:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8243 comm="syz.4.725" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 250.476297][ T30] audit: type=1326 audit(1751209841.447:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8243 comm="syz.4.725" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 250.551469][ T30] audit: type=1326 audit(1751209841.447:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8243 comm="syz.4.725" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 250.588776][ T30] audit: type=1326 audit(1751209841.447:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8243 comm="syz.4.725" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 250.596364][ T8259] ipvlan3: entered allmulticast mode [ 250.626164][ T30] audit: type=1326 audit(1751209841.447:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8243 comm="syz.4.725" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 250.675314][ T8259] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 250.686559][ T30] audit: type=1326 audit(1751209841.447:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8243 comm="syz.4.725" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 250.736265][ T30] audit: type=1326 audit(1751209841.447:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8243 comm="syz.4.725" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4800d8e929 code=0x7ffc0000 [ 251.246023][ T6392] usb 2-1: USB disconnect, device number 43 [ 251.683949][ T6400] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 251.865391][ T6400] usb 1-1: Using ep0 maxpacket: 16 [ 251.878250][ T6400] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 251.889205][ T6400] usb 1-1: can't read configurations, error -61 [ 251.906270][ T6392] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 251.957366][ T6397] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 252.022718][ T6400] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 252.042413][ T8297] netlink: 8 bytes leftover after parsing attributes in process `syz.4.744'. [ 252.084019][ T6392] usb 2-1: Using ep0 maxpacket: 32 [ 252.100780][ T6392] usb 2-1: config 0 has an invalid interface number: 35 but max is 0 [ 252.116006][ T6392] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 252.127865][ T6392] usb 2-1: config 0 has no interface number 0 [ 252.147211][ T6392] usb 2-1: config 0 interface 35 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 252.191182][ T6397] usb 4-1: config 160 has an invalid interface number: 200 but max is 0 [ 252.225337][ T6397] usb 4-1: config 160 has no interface number 0 [ 252.262674][ T6400] usb 1-1: Using ep0 maxpacket: 16 [ 252.264862][ T8299] bridge0: port 1(gretap0) entered blocking state [ 252.279263][ T6397] usb 4-1: config 160 interface 200 has no altsetting 0 [ 252.279467][ T8299] bridge0: port 1(gretap0) entered disabled state [ 252.293653][ T6400] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 252.298710][ T8299] gretap0: entered allmulticast mode [ 252.301751][ T6392] usb 2-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 252.326569][ T8299] bridge0: port 1(gretap0) entered blocking state [ 252.334179][ T8299] bridge0: port 1(gretap0) entered forwarding state [ 252.350978][ T6400] usb 1-1: can't read configurations, error -61 [ 252.390092][ T6392] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.400171][ T6397] usb 4-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b [ 252.439833][ T6400] usb usb1-port1: attempt power cycle [ 252.473400][ T6397] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.509235][ T6392] usb 2-1: Product: syz [ 252.513704][ T6392] usb 2-1: Manufacturer: syz [ 252.518474][ T6397] usb 4-1: Product: syz [ 252.523064][ T6392] usb 2-1: SerialNumber: syz [ 252.528219][ T6397] usb 4-1: Manufacturer: syz [ 252.535551][ T6397] usb 4-1: SerialNumber: syz [ 252.541126][ T6392] usb 2-1: config 0 descriptor?? [ 252.557831][ T6392] radio-si470x 2-1:0.35: could not find interrupt in endpoint [ 252.565824][ T6392] radio-si470x 2-1:0.35: probe with driver radio-si470x failed with error -5 [ 252.750987][ T6392] radio-raremono 2-1:0.35: this is not Thanko's Raremono. [ 252.784238][ T6392] usbhid 2-1:0.35: couldn't find an input interrupt endpoint [ 252.953650][ T6400] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 253.066990][ T6400] usb 1-1: Using ep0 maxpacket: 16 [ 253.084702][ T6400] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 253.092766][ T6392] usb 2-1: USB disconnect, device number 44 [ 253.104236][ T6400] usb 1-1: can't read configurations, error -61 [ 253.189198][ T8304] program syz.2.747 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 253.252752][ T6400] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 253.276395][ T6400] usb 1-1: Using ep0 maxpacket: 16 [ 253.284446][ T6400] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 253.292252][ T6400] usb 1-1: can't read configurations, error -61 [ 253.302862][ T6400] usb usb1-port1: unable to enumerate USB device [ 253.762887][ T6392] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 253.913799][ T6392] usb 3-1: device descriptor read/64, error -71 [ 254.112700][ T5912] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 254.152789][ T6392] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 254.275438][ T5912] usb 2-1: config 0 has no interfaces? [ 254.283092][ T6392] usb 3-1: device descriptor read/64, error -71 [ 254.286965][ T5912] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 254.301060][ T5912] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.363229][ T5912] usb 2-1: Product: syz [ 254.374698][ T5912] usb 2-1: Manufacturer: syz [ 254.393117][ T6392] usb usb3-port1: attempt power cycle [ 254.408345][ T5912] usb 2-1: SerialNumber: syz [ 254.475304][ T5912] usb 2-1: config 0 descriptor?? [ 254.742779][ T6392] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 254.818214][ T6397] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 254.825385][ T6392] usb 3-1: device descriptor read/8, error -71 [ 254.833358][ T6397] usb 4-1: MIDIStreaming interface descriptor not found [ 254.908766][ T6397] usb 4-1: USB disconnect, device number 33 [ 255.013105][ T6378] usb 1-1: new low-speed USB device number 35 using dummy_hcd [ 255.040757][ T5933] udevd[5933]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:160.200/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 255.063976][ T6392] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 255.114567][ T6392] usb 3-1: device descriptor read/8, error -71 [ 255.195358][ T6378] usb 1-1: config 65 has an invalid interface number: 95 but max is 0 [ 255.205238][ T6378] usb 1-1: config 65 has no interface number 0 [ 255.216977][ T6378] usb 1-1: string descriptor 0 read error: -22 [ 255.223187][ T6396] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 255.232460][ T6378] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=6f.b6 [ 255.246825][ T6392] usb usb3-port1: unable to enumerate USB device [ 255.249901][ T6378] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.285410][ T6378] usbtest 1-1:65.95: Linux gadget zero [ 255.285436][ T6378] usbtest 1-1:65.95: low-speed {control in/out} tests (+alt) [ 255.374950][ T6396] usb 5-1: config 0 has no interfaces? [ 255.393483][ T6396] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 255.411780][ T6396] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.450094][ T6396] usb 5-1: Product: syz [ 255.459154][ T6396] usb 5-1: Manufacturer: syz [ 255.476993][ T6396] usb 5-1: SerialNumber: syz [ 255.495629][ T8326] netlink: 36 bytes leftover after parsing attributes in process `syz.3.755'. [ 255.515979][ T6396] usb 5-1: config 0 descriptor?? [ 255.587702][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.594408][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.748395][ T8320] netlink: 20 bytes leftover after parsing attributes in process `syz.4.752'. [ 256.021113][ T5912] usb 1-1: USB disconnect, device number 35 [ 256.640683][ T8334] netlink: 'syz.2.758': attribute type 1 has an invalid length. [ 256.656857][ T8334] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 256.664374][ T8334] IPv6: NLM_F_CREATE should be set when creating new route [ 257.159076][ T8338] netlink: 152 bytes leftover after parsing attributes in process `syz.2.760'. [ 257.196448][ T8338] tipc: Started in network mode [ 257.213453][ T8338] tipc: Node identity fe80000000000000000000000000002a, cluster identity 4711 [ 257.261524][ T8338] tipc: Enabled bearer , priority 10 [ 257.630866][ T5912] usb 2-1: USB disconnect, device number 45 [ 257.706376][ T6396] usb 5-1: USB disconnect, device number 45 [ 257.828736][ T8344] netlink: 40 bytes leftover after parsing attributes in process `syz.1.762'. [ 258.068922][ T8354] vlan2: entered promiscuous mode [ 258.074184][ T8354] team0: entered promiscuous mode [ 258.079399][ T8354] bond0: entered promiscuous mode [ 258.100600][ T8352] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 258.143825][ T8356] veth1_to_team: entered promiscuous mode [ 258.172821][ T8358] netlink: 'syz.3.769': attribute type 46 has an invalid length. [ 258.212183][ T8358] netlink: 16 bytes leftover after parsing attributes in process `syz.3.769'. [ 258.221488][ T8358] netlink: 24 bytes leftover after parsing attributes in process `syz.3.769'. [ 258.242805][ T6396] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 258.283693][ T8362] netlink: 'syz.2.767': attribute type 13 has an invalid length. [ 258.404044][ T8362] bridge0: port 1(gretap0) entered disabled state [ 258.424944][ T8364] netlink: 'syz.1.771': attribute type 10 has an invalid length. [ 258.443059][ T8364] netlink: 40 bytes leftover after parsing attributes in process `syz.1.771'. [ 258.452759][ T6396] usb 5-1: Using ep0 maxpacket: 8 [ 258.483111][ T6396] usb 5-1: config 0 has an invalid interface number: 130 but max is 0 [ 258.504325][ T8367] netlink: 36 bytes leftover after parsing attributes in process `syz.3.772'. [ 258.511592][ T6396] usb 5-1: config 0 has no interface number 0 [ 258.522491][ T6396] usb 5-1: New USB device found, idVendor=2013, idProduct=0246, bcdDevice=e6.56 [ 258.532325][ T8367] netlink: 16 bytes leftover after parsing attributes in process `syz.3.772'. [ 258.542765][ T6396] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.550818][ T6396] usb 5-1: Product: syz [ 258.558851][ T8367] netlink: 36 bytes leftover after parsing attributes in process `syz.3.772'. [ 258.563860][ T6396] usb 5-1: Manufacturer: syz [ 258.572386][ T6396] usb 5-1: SerialNumber: syz [ 258.591524][ T6400] tipc: Node number set to 4269801514 [ 258.621832][ T6396] usb 5-1: config 0 descriptor?? [ 258.685908][ T6396] as10x_usb: device has been detected [ 258.692425][ T6396] dvbdev: DVB: registering new adapter (PCTV Systems picoStick (74e)) [ 258.753444][ T6396] usb 5-1: DVB: registering adapter 2 frontend 0 (PCTV Systems picoStick (74e))... [ 258.787381][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 258.787415][ T30] audit: type=1326 audit(1751209850.147:297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8369 comm="syz.0.774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa4e98e929 code=0x7ffc0000 [ 258.894783][ T6396] as10x_usb: error during firmware upload part1 [ 258.928393][ T30] audit: type=1326 audit(1751209850.147:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8369 comm="syz.0.774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa4e98e929 code=0x7ffc0000 [ 258.953825][ T6396] Registered device PCTV Systems picoStick (74e) [ 259.165543][ T30] audit: type=1326 audit(1751209850.147:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8369 comm="syz.0.774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=433 compat=0 ip=0x7ffa4e98e929 code=0x7ffc0000 [ 259.194175][ C0] vkms_vblank_simulate: vblank timer overrun [ 259.201599][ T977] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 259.300716][ T30] audit: type=1326 audit(1751209850.147:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8369 comm="syz.0.774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa4e98e929 code=0x7ffc0000 [ 259.329740][ T30] audit: type=1326 audit(1751209850.147:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8369 comm="syz.0.774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ffa4e98e929 code=0x7ffc0000 [ 259.353130][ T30] audit: type=1326 audit(1751209850.147:302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8369 comm="syz.0.774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa4e98e929 code=0x7ffc0000 [ 259.375422][ C0] vkms_vblank_simulate: vblank timer overrun [ 259.443736][ T977] usb 4-1: config 0 has no interfaces? [ 259.458621][ T977] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 259.470306][ T977] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.507917][ T977] usb 4-1: Product: syz [ 259.520931][ T977] usb 4-1: Manufacturer: syz [ 259.541084][ T30] audit: type=1326 audit(1751209850.147:303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8369 comm="syz.0.774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7ffa4e98e929 code=0x7ffc0000 [ 259.563569][ C0] vkms_vblank_simulate: vblank timer overrun [ 259.573453][ T977] usb 4-1: SerialNumber: syz [ 259.583918][ T977] usb 4-1: config 0 descriptor?? [ 259.593511][ T30] audit: type=1326 audit(1751209850.147:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8369 comm="syz.0.774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa4e98e929 code=0x7ffc0000 [ 259.682513][ T30] audit: type=1326 audit(1751209850.147:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8369 comm="syz.0.774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7ffa4e98e929 code=0x7ffc0000 [ 259.746237][ T30] audit: type=1326 audit(1751209850.147:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8369 comm="syz.0.774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa4e98e929 code=0x7ffc0000 [ 260.048064][ T8362] team0: left allmulticast mode [ 260.235245][ T8362] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.271044][ T8362] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.296284][ T8362] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.340908][ T8362] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.366994][ T8364] batman_adv: batadv0: Adding interface: vlan1 [ 260.373388][ T8364] batman_adv: batadv0: The MTU of interface vlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 260.410220][ T8364] batman_adv: batadv0: Interface activated: vlan1 [ 260.781943][ T8391] openvswitch: netlink: Multiple metadata blocks provided [ 261.130362][ T9] usb 5-1: USB disconnect, device number 46 [ 261.195903][ T9] Unregistered device PCTV Systems picoStick (74e) [ 261.201790][ T9] as10x_usb: device has been disconnected [ 262.245857][ T977] usb 4-1: USB disconnect, device number 34 [ 262.433145][ T6390] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 262.505553][ T8402] capability: warning: `syz.1.780' uses deprecated v2 capabilities in a way that may be insecure [ 262.602787][ T6390] usb 5-1: Using ep0 maxpacket: 16 [ 262.649263][ T6390] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 262.684962][ T6390] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 262.754182][ T6390] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 262.834558][ T6390] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 262.943720][ T6390] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.952036][ T6390] usb 5-1: Product: syz [ 262.957706][ T6390] usb 5-1: Manufacturer: syz [ 262.963232][ T6390] usb 5-1: SerialNumber: syz [ 263.118316][ T8410] __nla_validate_parse: 2 callbacks suppressed [ 263.118336][ T8410] netlink: 4 bytes leftover after parsing attributes in process `syz.0.784'. [ 263.152088][ T8410] netlink: 4 bytes leftover after parsing attributes in process `syz.0.784'. [ 263.257833][ T6390] usb 5-1: 2:1 : format type 0 is detected, processed as PCM [ 263.288816][ T6390] usb 5-1: 2:1: cannot set freq 9338507 to ep 0x82 [ 263.479832][ T8418] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 263.487178][ T8418] IPv6: NLM_F_CREATE should be set when creating new route [ 263.494607][ T8418] IPv6: NLM_F_CREATE should be set when creating new route [ 263.501937][ T8418] IPv6: NLM_F_CREATE should be set when creating new route [ 263.692817][ T6384] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 263.804578][ T5912] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 263.887444][ T6390] usb 5-1: USB disconnect, device number 47 [ 263.907084][ T6384] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 263.930602][ T6384] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 264.019928][ T5912] usb 4-1: Using ep0 maxpacket: 16 [ 264.047898][ T6384] usb 2-1: config 0 descriptor?? [ 264.079182][ T5933] udevd[5933]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 264.112902][ T5912] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 264.126080][ T6384] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 264.137251][ T5912] usb 4-1: config 0 interface 0 has no altsetting 0 [ 264.155568][ T5912] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 264.164881][ T5912] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.176810][ T5912] usb 4-1: Product: syz [ 264.181281][ T5912] usb 4-1: Manufacturer: syz [ 264.194180][ T5912] usb 4-1: SerialNumber: syz [ 264.237433][ T5912] usb 4-1: config 0 descriptor?? [ 264.256557][ T5912] hub 4-1:0.0: bad descriptor, ignoring hub [ 264.292893][ T5912] hub 4-1:0.0: probe with driver hub failed with error -5 [ 264.514969][ T5912] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 264.679745][ T2998] usb 4-1: Failed to submit usb control message: -71 [ 264.716183][ T6384] gp8psk: usb in 146 operation failed. [ 264.726676][ T6384] gp8psk: failed to get FW version [ 264.770573][ T6384] gp8psk: usb in 149 operation failed. [ 264.777284][ T6384] gp8psk: failed to get FPGA version [ 264.797047][ T6384] gp8psk: usb out operation failed. [ 264.816255][ T2998] usb 4-1: unable to send the bmi data to the device: -71 [ 264.820927][ T6384] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 264.859921][ T6384] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 264.884041][ T6384] usb 2-1: USB disconnect, device number 46 [ 264.903230][ T6390] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 264.968832][ T2998] usb 4-1: unable to get target info from device [ 264.989582][ T2998] usb 4-1: could not get target info (-71) [ 264.998865][ T2998] usb 4-1: could not probe fw (-71) [ 265.133636][ T6390] usb 1-1: config 0 has no interfaces? [ 265.144494][ T6390] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 265.154959][ T6390] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.164318][ T6390] usb 1-1: Product: syz [ 265.175021][ T6390] usb 1-1: Manufacturer: syz [ 265.188232][ T6390] usb 1-1: SerialNumber: syz [ 265.217028][ T6390] usb 1-1: config 0 descriptor?? [ 265.619751][ T8439] netlink: 20 bytes leftover after parsing attributes in process `syz.0.791'. [ 265.890503][ T8450] netlink: 56 bytes leftover after parsing attributes in process `syz.2.795'. [ 265.918494][ T8450] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.930214][ T8450] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.989771][ T8450] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 266.018933][ T8450] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 266.483322][ T977] usb 2-1: new low-speed USB device number 47 using dummy_hcd [ 266.665882][ T977] usb 2-1: config 65 has an invalid interface number: 95 but max is 0 [ 266.706689][ T977] usb 2-1: config 65 has no interface number 0 [ 266.912318][ T8459] netlink: 72 bytes leftover after parsing attributes in process `syz.4.799'. [ 266.993016][ T5889] usb 4-1: USB disconnect, device number 35 [ 267.666606][ T6390] usb 1-1: USB disconnect, device number 36 [ 268.265708][ T8498] FAULT_INJECTION: forcing a failure. [ 268.265708][ T8498] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 268.288439][ T8498] CPU: 1 UID: 0 PID: 8498 Comm: syz.4.813 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 268.288468][ T8498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 268.288480][ T8498] Call Trace: [ 268.288488][ T8498] [ 268.288496][ T8498] dump_stack_lvl+0x189/0x250 [ 268.288533][ T8498] ? __pfx____ratelimit+0x10/0x10 [ 268.288561][ T8498] ? __pfx_dump_stack_lvl+0x10/0x10 [ 268.288590][ T8498] ? __pfx__printk+0x10/0x10 [ 268.288611][ T8498] ? __might_fault+0xb0/0x130 [ 268.288656][ T8498] should_fail_ex+0x414/0x560 [ 268.288686][ T8498] _copy_from_user+0x2d/0xb0 [ 268.288707][ T8498] ___sys_recvmsg+0x12e/0x510 [ 268.288740][ T8498] ? __pfx____sys_recvmsg+0x10/0x10 [ 268.288801][ T8498] ? __might_fault+0xb0/0x130 [ 268.288826][ T8498] do_recvmmsg+0x307/0x770 [ 268.288860][ T8498] ? __pfx_do_recvmmsg+0x10/0x10 [ 268.288897][ T8498] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 268.288946][ T8498] __x64_sys_recvmmsg+0x190/0x240 [ 268.288976][ T8498] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 268.289003][ T8498] ? rcu_is_watching+0x15/0xb0 [ 268.289038][ T8498] ? do_syscall_64+0xbe/0x3b0 [ 268.289073][ T8498] do_syscall_64+0xfa/0x3b0 [ 268.289102][ T8498] ? lockdep_hardirqs_on+0x9c/0x150 [ 268.289130][ T8498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.289150][ T8498] ? clear_bhb_loop+0x60/0xb0 [ 268.289175][ T8498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.289193][ T8498] RIP: 0033:0x7f4800d8e929 [ 268.289212][ T8498] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 268.289230][ T8498] RSP: 002b:00007f4801bc2038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 268.289252][ T8498] RAX: ffffffffffffffda RBX: 00007f4800fb5fa0 RCX: 00007f4800d8e929 [ 268.289267][ T8498] RDX: 0000000000000600 RSI: 0000200000003700 RDI: 0000000000000004 [ 268.289280][ T8498] RBP: 00007f4801bc2090 R08: 0000000000000000 R09: 0000000000000000 [ 268.289292][ T8498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 268.289303][ T8498] R13: 0000000000000000 R14: 00007f4800fb5fa0 R15: 00007f48010dfa28 [ 268.289333][ T8498] [ 268.452844][ T5889] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 268.522820][ T6390] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 268.640151][ T8501] netlink: 56 bytes leftover after parsing attributes in process `syz.4.814'. [ 268.715465][ T6390] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 268.729106][ T6390] usb 4-1: config 0 interface 0 has no altsetting 0 [ 268.757125][ T6390] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 268.771102][ T6390] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 268.790238][ T6390] usb 4-1: Product: syz [ 268.799722][ T6390] usb 4-1: Manufacturer: syz [ 268.809828][ T6390] usb 4-1: SerialNumber: syz [ 268.826337][ T6390] usb 4-1: config 0 descriptor?? [ 268.855057][ T5889] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 268.875836][ T5889] usb 3-1: config 0 interface 0 has no altsetting 0 [ 268.906153][ T6390] usb 4-1: selecting invalid altsetting 0 [ 268.924536][ T5889] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 268.947917][ T5889] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 268.976019][ T5889] usb 3-1: Product: syz [ 268.980312][ T5889] usb 3-1: Manufacturer: syz [ 268.995108][ T5889] usb 3-1: SerialNumber: syz [ 269.032261][ T5889] usb 3-1: config 0 descriptor?? [ 269.075797][ T5889] usb 3-1: selecting invalid altsetting 0 [ 269.198380][ T6384] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 269.224057][ T977] usb 2-1: string descriptor 0 read error: -71 [ 269.230417][ T977] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=6f.b6 [ 269.317701][ T977] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.384358][ T977] usb 2-1: can't set config #65, error -71 [ 269.393341][ T8507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.415311][ T6384] usb 5-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 269.425077][ T977] usb 2-1: USB disconnect, device number 47 [ 269.463327][ T6384] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.472305][ T8507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.492292][ T8507] netlink: 8 bytes leftover after parsing attributes in process `syz.3.811'. [ 269.513971][ T6384] usb 5-1: Product: syz [ 269.518749][ T6384] usb 5-1: Manufacturer: syz [ 269.543570][ T5912] usb 3-1: USB disconnect, device number 40 [ 269.563438][ T6384] usb 5-1: SerialNumber: syz [ 269.602357][ T6384] usb 5-1: config 0 descriptor?? [ 269.638403][ T6384] ch341 5-1:0.0: ch341-uart converter detected [ 270.144171][ T8523] netlink: 632 bytes leftover after parsing attributes in process `syz.1.823'. [ 270.212833][ T977] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 270.408217][ T977] usb 1-1: config 0 has no interfaces? [ 270.427185][ T977] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 270.500399][ T8534] fuse: Bad value for 'fd' [ 270.502845][ T977] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.521901][ T977] usb 1-1: Product: syz [ 270.537347][ T977] usb 1-1: Manufacturer: syz [ 270.550661][ T977] usb 1-1: SerialNumber: syz [ 270.568384][ T977] usb 1-1: config 0 descriptor?? [ 270.633235][ T6384] usb 5-1: ch341-uart converter now attached to ttyUSB0 [ 270.792238][ T8519] netlink: 20 bytes leftover after parsing attributes in process `syz.0.818'. [ 270.949727][ T6384] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 271.151578][ T6384] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 271.183456][ T6384] usb 2-1: config 0 has no interfaces? [ 271.201545][ T6384] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 271.216887][ T6390] usb 4-1: USB disconnect, device number 36 [ 271.221782][ T6384] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 271.252046][ T6384] usb 2-1: SerialNumber: syz [ 271.277805][ T6384] usb 2-1: config 0 descriptor?? [ 271.500779][ T6384] usb 2-1: USB disconnect, device number 48 [ 271.911968][ T8554] netlink: 12 bytes leftover after parsing attributes in process `syz.2.835'. [ 271.932771][ T6390] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 271.934147][ T8554] vlan2: entered promiscuous mode [ 271.976287][ T6378] usb 5-1: USB disconnect, device number 48 [ 272.014224][ T6378] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 272.046610][ T6378] ch341 5-1:0.0: device disconnected [ 272.092870][ T6390] usb 4-1: Using ep0 maxpacket: 8 [ 272.129292][ T6390] usb 4-1: unable to get BOS descriptor or descriptor too short [ 272.151805][ T8558] netlink: 4 bytes leftover after parsing attributes in process `syz.2.837'. [ 272.159285][ T6390] usb 4-1: config 127 has an invalid interface number: 8 but max is 0 [ 272.170413][ T8558] netlink: 4 bytes leftover after parsing attributes in process `syz.2.837'. [ 272.172439][ T6390] usb 4-1: config 127 has no interface number 0 [ 272.189966][ T6390] usb 4-1: config 127 interface 8 altsetting 249 bulk endpoint 0xC has invalid maxpacket 64 [ 272.207491][ T6390] usb 4-1: config 127 interface 8 has no altsetting 0 [ 272.229172][ T6390] usb 4-1: New USB device found, idVendor=1199, idProduct=c081, bcdDevice=7c.e1 [ 272.268684][ T6390] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.281648][ T6390] usb 4-1: Product: syz [ 272.286686][ T6390] usb 4-1: Manufacturer: syz [ 272.291377][ T6390] usb 4-1: SerialNumber: syz [ 272.308893][ T8547] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 272.453145][ T6378] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 272.591418][ T6390] usb 4-1: USB disconnect, device number 37 [ 272.613248][ T6378] usb 5-1: Using ep0 maxpacket: 16 [ 272.623349][ T5889] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 272.638498][ T6378] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 272.650886][ T6378] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 272.667240][ T6378] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.690655][ T6378] usb 5-1: config 0 descriptor?? [ 272.718693][ T8570] netlink: 28 bytes leftover after parsing attributes in process `syz.2.842'. [ 272.793945][ T5889] usb 2-1: Using ep0 maxpacket: 8 [ 272.805820][ T5889] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 272.819323][ T5889] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.830670][ T5889] usb 2-1: Product: syz [ 272.836287][ T5889] usb 2-1: Manufacturer: syz [ 272.841060][ T5889] usb 2-1: SerialNumber: syz [ 272.855651][ T5889] usb 2-1: config 0 descriptor?? [ 272.906826][ T977] usb 1-1: USB disconnect, device number 37 [ 272.928219][ T8556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 272.946467][ T8556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.065438][ T5889] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 273.199276][ T8578] binder: 8577:8578 unknown command 0 [ 273.205286][ T8578] binder: 8577:8578 ioctl c0306201 2000000002c0 returned -22 [ 273.250215][ T6378] mcp2221 0003:04D8:00DD.0009: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 273.576671][ T8587] fuse: Unknown parameter '' [ 274.314933][ T8590] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 274.431465][ T6378] usb 5-1: USB disconnect, device number 49 [ 274.543392][ T5889] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 275.330075][ T6384] usb 2-1: USB disconnect, device number 49 [ 275.642878][ T5833] Bluetooth: hci0: unexpected event 0x20 length: 19 > 7 [ 276.049428][ T8604] sctp: [Deprecated]: syz.4.849 (pid 8604) Use of int in maxseg socket option. [ 276.049428][ T8604] Use struct sctp_assoc_value instead [ 276.139588][ T8604] netlink: 'syz.4.849': attribute type 10 has an invalid length. [ 278.428016][ T8624] netlink: 8 bytes leftover after parsing attributes in process `syz.2.853'. [ 278.522806][ T6378] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 278.977112][ T6378] usb 1-1: config 0 has no interfaces? [ 279.054382][ T6378] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 279.070972][ T6378] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.090548][ T6378] usb 1-1: Product: syz [ 279.095288][ T6378] usb 1-1: Manufacturer: syz [ 279.099952][ T6378] usb 1-1: SerialNumber: syz [ 279.136371][ T6378] usb 1-1: config 0 descriptor?? [ 279.209033][ T8631] FAULT_INJECTION: forcing a failure. [ 279.209033][ T8631] name failslab, interval 1, probability 0, space 0, times 0 [ 279.258584][ T8631] CPU: 1 UID: 0 PID: 8631 Comm: syz.1.859 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 279.258618][ T8631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 279.258630][ T8631] Call Trace: [ 279.258639][ T8631] [ 279.258649][ T8631] dump_stack_lvl+0x189/0x250 [ 279.258686][ T8631] ? __pfx____ratelimit+0x10/0x10 [ 279.258716][ T8631] ? __pfx_dump_stack_lvl+0x10/0x10 [ 279.258749][ T8631] ? __pfx__printk+0x10/0x10 [ 279.258767][ T8631] ? xfrm_policy_lookup_bytype+0x11ef/0x1250 [ 279.258801][ T8631] ? __lock_acquire+0xab9/0xd20 [ 279.258833][ T8631] should_fail_ex+0x414/0x560 [ 279.258864][ T8631] should_failslab+0xa8/0x100 [ 279.258888][ T8631] kmem_cache_alloc_noprof+0x73/0x3c0 [ 279.258920][ T8631] ? dst_alloc+0x105/0x170 [ 279.258952][ T8631] dst_alloc+0x105/0x170 [ 279.258989][ T8631] xfrm_alloc_dst+0x76/0x160 [ 279.259018][ T8631] xfrm_lookup_with_ifid+0x77e/0x1a70 [ 279.259051][ T8631] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 279.259089][ T8631] xfrm_lookup_route+0x3c/0x1c0 [ 279.259114][ T8631] udp_sendmsg+0x1405/0x2300 [ 279.259148][ T8631] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 279.259180][ T8631] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 279.259209][ T8631] ? __pfx_udp_sendmsg+0x10/0x10 [ 279.259248][ T8631] ? count_memcg_event_mm+0x21/0x260 [ 279.259285][ T8631] ? count_memcg_event_mm+0x21/0x260 [ 279.259329][ T8631] ? __pfx_aa_sk_perm+0x10/0x10 [ 279.259350][ T8631] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 279.259383][ T8631] ? sock_rps_record_flow+0x19/0x410 [ 279.259417][ T8631] ? inet_sendmsg+0x29c/0x370 [ 279.259446][ T8631] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 279.259475][ T8631] __sock_sendmsg+0x19c/0x270 [ 279.259509][ T8631] ____sys_sendmsg+0x52d/0x830 [ 279.259537][ T8631] ? __pfx_____sys_sendmsg+0x10/0x10 [ 279.259569][ T8631] ? import_iovec+0x74/0xa0 [ 279.259591][ T8631] ___sys_sendmsg+0x21f/0x2a0 [ 279.259618][ T8631] ? __pfx____sys_sendmsg+0x10/0x10 [ 279.259679][ T8631] ? __fget_files+0x2a/0x420 [ 279.259702][ T8631] ? __fget_files+0x3a0/0x420 [ 279.259736][ T8631] __sys_sendmmsg+0x227/0x430 [ 279.259768][ T8631] ? __pfx___sys_sendmmsg+0x10/0x10 [ 279.259791][ T8631] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 279.259852][ T8631] ? ksys_write+0x22a/0x250 [ 279.259874][ T8631] ? __pfx_ksys_write+0x10/0x10 [ 279.259890][ T8631] ? rcu_is_watching+0x15/0xb0 [ 279.259930][ T8631] __x64_sys_sendmmsg+0xa0/0xc0 [ 279.259957][ T8631] do_syscall_64+0xfa/0x3b0 [ 279.259994][ T8631] ? lockdep_hardirqs_on+0x9c/0x150 [ 279.260021][ T8631] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 279.260042][ T8631] ? clear_bhb_loop+0x60/0xb0 [ 279.260067][ T8631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 279.260087][ T8631] RIP: 0033:0x7f24ee18e929 [ 279.260106][ T8631] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 279.260124][ T8631] RSP: 002b:00007f24ef08b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 279.260147][ T8631] RAX: ffffffffffffffda RBX: 00007f24ee3b5fa0 RCX: 00007f24ee18e929 [ 279.260163][ T8631] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000006 [ 279.260177][ T8631] RBP: 00007f24ef08b090 R08: 0000000000000000 R09: 0000000000000000 [ 279.260190][ T8631] R10: 0000000000000bb8 R11: 0000000000000246 R12: 0000000000000001 [ 279.260202][ T8631] R13: 0000000000000000 R14: 00007f24ee3b5fa0 R15: 00007f24ee4dfa28 [ 279.260234][ T8631] [ 279.727092][ T8618] netlink: 20 bytes leftover after parsing attributes in process `syz.0.854'. [ 280.044448][ T8628] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 280.165659][ T8643] netlink: 'syz.1.861': attribute type 1 has an invalid length. [ 280.233787][ T8643] 8021q: adding VLAN 0 to HW filter on device bond3 [ 280.353632][ T8643] bond2: (slave veth0_to_bond): Releasing active interface [ 280.426872][ T8643] bond3: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 280.500563][ T8656] PKCS7: Unknown OID: [5] (bad) [ 280.505898][ T8656] PKCS7: Only support pkcs7_signedData type [ 280.613673][ T6376] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 280.780486][ T6376] usb 3-1: Using ep0 maxpacket: 16 [ 280.820637][ T6376] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 280.872917][ T6390] usb 4-1: new low-speed USB device number 38 using dummy_hcd [ 280.883629][ T6376] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 280.946094][ T6376] usb 3-1: config 0 has no interface number 0 [ 280.987904][ T6376] usb 3-1: config 0 interface 35 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 281.038938][ T6390] usb 4-1: device descriptor read/64, error -71 [ 281.074837][ T6378] usb 1-1: USB disconnect, device number 38 [ 281.113232][ T6376] usb 3-1: config 0 interface 35 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 281.256278][ T6376] usb 3-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 281.271406][ T6376] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.356721][ T6390] usb 4-1: new low-speed USB device number 39 using dummy_hcd [ 281.384908][ T6376] usb 3-1: Product: syz [ 281.389181][ T6376] usb 3-1: Manufacturer: syz [ 281.430764][ T6376] usb 3-1: SerialNumber: syz [ 281.478376][ T6376] usb 3-1: config 0 descriptor?? [ 281.533467][ T6390] usb 4-1: device descriptor read/64, error -71 [ 281.549893][ T6376] cypress_m8 3-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 281.577299][ T6376] nokiaca42v2 ttyUSB0: required endpoint is missing [ 281.683115][ T6390] usb usb4-port1: attempt power cycle [ 281.749013][ T6376] usb 3-1: USB disconnect, device number 41 [ 281.842809][ T6376] cypress_m8 3-1:0.35: device disconnected [ 282.061476][ T6390] usb 4-1: new low-speed USB device number 40 using dummy_hcd [ 282.203118][ T6390] usb 4-1: device descriptor read/8, error -71 [ 282.428211][ T8679] syzkaller1: entered promiscuous mode [ 282.434623][ T8679] syzkaller1: entered allmulticast mode [ 282.603094][ T6390] usb 4-1: new low-speed USB device number 41 using dummy_hcd [ 282.766603][ T6390] usb 4-1: device descriptor read/8, error -71 [ 282.976878][ T6390] usb usb4-port1: unable to enumerate USB device [ 283.812867][ T8701] vlan2: entered promiscuous mode [ 283.831999][ T8703] netlink: 'syz.0.876': attribute type 1 has an invalid length. [ 283.926990][ T8703] netlink: 4 bytes leftover after parsing attributes in process `syz.0.876'. [ 284.316767][ T8713] bridge0: port 3(gretap0) entered blocking state [ 284.350333][ T8713] bridge0: port 3(gretap0) entered disabled state [ 284.426099][ T8713] gretap0: entered allmulticast mode [ 284.471115][ T8713] gretap0: entered promiscuous mode [ 284.510025][ T8713] bridge0: port 3(gretap0) entered blocking state [ 284.516716][ T8713] bridge0: port 3(gretap0) entered forwarding state [ 284.662804][ T6378] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 284.763009][ T8722] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 284.769806][ T8722] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 284.840701][ T8722] vhci_hcd vhci_hcd.0: Device attached [ 284.868000][ T6378] usb 3-1: config 0 has no interfaces? [ 284.885774][ T8726] vhci_hcd: connection closed [ 284.888227][ T13] vhci_hcd: stop threads [ 284.916651][ T6378] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 284.942812][ T6378] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.951863][ T13] vhci_hcd: release socket [ 284.974530][ T13] vhci_hcd: disconnect device [ 284.983262][ T6376] vhci_hcd: vhci_device speed not set [ 284.995100][ T6378] usb 3-1: Product: syz [ 284.999346][ T6378] usb 3-1: Manufacturer: syz [ 285.011896][ T8730] netlink: 8 bytes leftover after parsing attributes in process `syz.1.883'. [ 285.041826][ T6378] usb 3-1: SerialNumber: syz [ 285.058175][ T6378] usb 3-1: config 0 descriptor?? [ 285.169954][ T8725] BUG: Bad page state in process syz.3.882 pfn:4f601 [ 285.211268][ T8725] page does not match folio [ 285.227506][ T8725] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x4f601 [ 285.260242][ T8725] ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 285.290369][ T8718] netlink: 20 bytes leftover after parsing attributes in process `syz.2.878'. [ 285.318113][ T8725] raw: 00fff00000000000 ffffea00013d8000 00000000ffffffff ffffffffffffffff [ 285.327439][ T8725] raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000 [ 285.392245][ T8725] page dumped because: nonzero pincount [ 285.417383][ T8725] page_owner tracks the page as allocated [ 285.452474][ T8725] page last allocated via order 9, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 8724, tgid 8724 (syz.3.882), ts 284740712194, free_ts 265285909050 [ 285.552950][ T8725] post_alloc_hook+0x240/0x2a0 [ 285.557989][ T8725] get_page_from_freelist+0x21e4/0x22c0 [ 285.607983][ T8725] __alloc_frozen_pages_noprof+0x181/0x370 [ 285.634741][ T8725] alloc_pages_mpol+0x232/0x4a0 [ 285.649494][ T8725] alloc_pages_noprof+0xa9/0x190 [ 285.673352][ T8725] folio_alloc_noprof+0x1e/0x30 [ 285.692212][ T8725] filemap_alloc_folio_noprof+0xdf/0x470 [ 285.716954][ T8725] page_cache_ra_order+0x5e5/0xc70 [ 285.736226][ T8725] do_sync_mmap_readahead+0x31a/0x5f0 [ 285.761277][ T8725] filemap_fault+0x62a/0x1200 [ 285.778657][ T8725] __do_fault+0x135/0x390 [ 285.796416][ T8725] __handle_mm_fault+0x198b/0x5620 [ 285.811411][ T8725] handle_mm_fault+0x40a/0x8e0 [ 285.837113][ T8725] do_user_addr_fault+0xa81/0x1390 [ 285.859523][ T8725] exc_page_fault+0x76/0xf0 [ 285.876241][ T8725] asm_exc_page_fault+0x26/0x30 [ 285.891613][ T8725] page last free pid 3025 tgid 3025 stack trace: [ 285.915204][ T8725] free_unref_folios+0xc66/0x14d0 [ 285.933375][ T8725] folios_put_refs+0x559/0x640 [ 285.946400][ T8725] release_pages+0x4b4/0x520 [ 285.960284][ T8725] io_free_region+0xb4/0x270 [ 286.016111][ T8725] io_ring_ctx_free+0x2b0/0x500 [ 286.027898][ T8725] io_ring_exit_work+0x8c4/0x930 [ 286.043826][ T8725] process_scheduled_works+0xae1/0x17b0 [ 286.058751][ T8725] worker_thread+0x8a0/0xda0 [ 286.069767][ T8725] kthread+0x70e/0x8a0 [ 286.079734][ T8725] ret_from_fork+0x3fc/0x770 [ 286.095014][ T8725] ret_from_fork_asm+0x1a/0x30 [ 286.117062][ T8725] Modules linked in: [ 286.130440][ T8725] CPU: 0 UID: 0 PID: 8725 Comm: syz.3.882 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 286.130471][ T8725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 286.130485][ T8725] Call Trace: [ 286.130496][ T8725] [ 286.130504][ T8725] dump_stack_lvl+0x189/0x250 [ 286.130535][ T8725] ? __pfx_dump_stack_lvl+0x10/0x10 [ 286.130572][ T8725] ? __pfx_print_modules+0x10/0x10 [ 286.130601][ T8725] ? percpu_ref_put+0x19/0x180 [ 286.130627][ T8725] ? percpu_ref_put+0xf9/0x180 [ 286.130651][ T8725] bad_page+0x180/0x1c0 [ 286.130674][ T8725] free_tail_page_prepare+0x2c3/0x4f0 [ 286.130693][ T8725] __free_frozen_pages+0x8aa/0xe70 [ 286.130730][ T8725] __folio_put+0x21b/0x2c0 [ 286.130757][ T8725] ? __pfx___folio_put+0x10/0x10 [ 286.130793][ T8725] delete_from_page_cache_batch+0x84c/0x9b0 [ 286.130808][ T8725] ? shmem_mapping+0xd/0x50 [ 286.130832][ T8725] ? __pfx_delete_from_page_cache_batch+0x10/0x10 [ 286.130861][ T8725] ? __filemap_fdatawait_range+0x1d2/0x230 [ 286.130885][ T8725] ? __pfx_workingset_update_node+0x10/0x10 [ 286.130913][ T8725] ? folio_mapping+0x16f/0x240 [ 286.130942][ T8725] ? truncate_cleanup_folio+0x34a/0x430 [ 286.130973][ T8725] truncate_inode_pages_range+0x28a/0xda0 [ 286.131006][ T8725] ? __pfx_truncate_inode_pages_range+0x10/0x10 [ 286.131077][ T8725] ? smp_call_function_many_cond+0xbc5/0x12d0 [ 286.131111][ T8725] ? lockdep_hardirqs_on+0x9c/0x150 [ 286.131158][ T8725] ? __pfx_has_bh_in_lru+0x10/0x10 [ 286.131192][ T8725] blkdev_flush_mapping+0x108/0x270 [ 286.131225][ T8725] ? bdev_release+0x40f/0x650 [ 286.131259][ T8725] bdev_release+0x417/0x650 [ 286.131287][ T8725] ? __pfx_blkdev_release+0x10/0x10 [ 286.131301][ T8725] blkdev_release+0x15/0x20 [ 286.131315][ T8725] __fput+0x44c/0xa70 [ 286.131361][ T8725] task_work_run+0x1d1/0x260 [ 286.131392][ T8725] ? __pfx_task_work_run+0x10/0x10 [ 286.131426][ T8725] do_exit+0x6b5/0x22e0 [ 286.131449][ T8725] ? do_raw_spin_lock+0x121/0x290 [ 286.131469][ T8725] ? __pfx_do_exit+0x10/0x10 [ 286.131514][ T8725] do_group_exit+0x21c/0x2d0 [ 286.131539][ T8725] ? lockdep_hardirqs_on+0x9c/0x150 [ 286.131571][ T8725] get_signal+0x1286/0x1340 [ 286.131609][ T8725] arch_do_signal_or_restart+0x9a/0x750 [ 286.131643][ T8725] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 286.131688][ T8725] ? exit_to_user_mode_loop+0x40/0x110 [ 286.131723][ T8725] exit_to_user_mode_loop+0x75/0x110 [ 286.131745][ T8725] do_syscall_64+0x2bd/0x3b0 [ 286.131767][ T8725] ? lockdep_hardirqs_on+0x9c/0x150 [ 286.131796][ T8725] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.131818][ T8725] ? clear_bhb_loop+0x60/0xb0 [ 286.131843][ T8725] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.131863][ T8725] RIP: 0033:0x7f3c8f38e929 [ 286.131881][ T8725] Code: Unable to access opcode bytes at 0x7f3c8f38e8ff. [ 286.131888][ T8725] RSP: 002b:00007f3c902e00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 286.131904][ T8725] RAX: 0000000000000001 RBX: 00007f3c8f5b5fa8 RCX: 00007f3c8f38e929 [ 286.131915][ T8725] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f3c8f5b5fac [ 286.131925][ T8725] RBP: 00007f3c8f5b5fa0 R08: 7fffffffffffffff R09: 0000000000000000 [ 286.131939][ T8725] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f3c8f5b5fac [ 286.131955][ T8725] R13: 0000000000000000 R14: 00007f3c8f6df940 R15: 00007f3c8f6dfa28 [ 286.131988][ T8725] [ 286.516829][ T8725] Disabling lock debugging due to kernel taint [ 286.523244][ T8725] BUG: Bad page state in process syz.3.882 pfn:4f600 [ 286.541804][ T8725] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4f600 [ 286.566277][ T8725] head: order:0 mapcount:0 entire_mapcount:1 nr_pages_mapped:0 pincount:0 [ 286.579816][ T8725] flags: 0xfff0000000004d(locked|referenced|uptodate|head|node=0|zone=1|lastcpupid=0x7ff) [ 286.591009][ T8725] raw: 00fff0000000004d dead000000000100 dead000000000122 0000000000000000 [ 286.600594][ T8725] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 286.610463][ T8725] head: 00fff0000000004d dead000000000100 dead000000000122 0000000000000000 [ 286.619591][ T8725] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 286.652688][ T8725] head: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 286.661623][ T8725] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000 [ 286.672257][ T8725] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set [ 286.679979][ T8725] page_owner tracks the page as allocated [ 286.686539][ T8725] page last allocated via order 9, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 8724, tgid 8724 (syz.3.882), ts 284740712194, free_ts 265285909050 [ 286.708129][ T8725] post_alloc_hook+0x240/0x2a0 [ 286.713287][ T8725] get_page_from_freelist+0x21e4/0x22c0 [ 286.719036][ T8725] __alloc_frozen_pages_noprof+0x181/0x370 [ 286.730806][ T8725] alloc_pages_mpol+0x232/0x4a0 [ 286.736084][ T8725] alloc_pages_noprof+0xa9/0x190 [ 286.741188][ T8725] folio_alloc_noprof+0x1e/0x30 [ 286.746576][ T8725] filemap_alloc_folio_noprof+0xdf/0x470 [ 286.752402][ T8725] page_cache_ra_order+0x5e5/0xc70 [ 286.758047][ T8725] do_sync_mmap_readahead+0x31a/0x5f0 [ 286.763814][ T8725] filemap_fault+0x62a/0x1200 [ 286.768663][ T8725] __do_fault+0x135/0x390 [ 286.773476][ T8725] __handle_mm_fault+0x198b/0x5620 [ 286.778859][ T8725] handle_mm_fault+0x40a/0x8e0 [ 286.784210][ T8725] do_user_addr_fault+0xa81/0x1390 [ 286.789561][ T8725] exc_page_fault+0x76/0xf0 [ 286.796814][ T8725] asm_exc_page_fault+0x26/0x30 [ 286.801883][ T8725] page last free pid 3025 tgid 3025 stack trace: [ 286.808713][ T8725] free_unref_folios+0xc66/0x14d0 [ 286.814181][ T8725] folios_put_refs+0x559/0x640 [ 286.819095][ T8725] release_pages+0x4b4/0x520 [ 286.824473][ T8725] io_free_region+0xb4/0x270 [ 286.829201][ T8725] io_ring_ctx_free+0x2b0/0x500 [ 286.834650][ T8725] io_ring_exit_work+0x8c4/0x930 [ 286.839719][ T8725] process_scheduled_works+0xae1/0x17b0 [ 286.845922][ T8725] worker_thread+0x8a0/0xda0 [ 286.850664][ T8725] kthread+0x70e/0x8a0 [ 286.855183][ T8725] ret_from_fork+0x3fc/0x770 [ 286.860004][ T8725] ret_from_fork_asm+0x1a/0x30 [ 286.865520][ T8725] Modules linked in: [ 286.869572][ T8725] CPU: 0 UID: 0 PID: 8725 Comm: syz.3.882 Tainted: G B 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 286.869604][ T8725] Tainted: [B]=BAD_PAGE [ 286.869612][ T8725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 286.869624][ T8725] Call Trace: [ 286.869633][ T8725] [ 286.869658][ T8725] dump_stack_lvl+0x189/0x250 [ 286.869698][ T8725] ? __pfx_dump_stack_lvl+0x10/0x10 [ 286.869731][ T8725] ? __pfx_print_modules+0x10/0x10 [ 286.869772][ T8725] bad_page+0x180/0x1c0 [ 286.869800][ T8725] __free_frozen_pages+0xe17/0xe70 [ 286.869825][ T8725] __folio_put+0x21b/0x2c0 [ 286.869849][ T8725] ? __pfx___folio_put+0x10/0x10 [ 286.869876][ T8725] delete_from_page_cache_batch+0x84c/0x9b0 [ 286.869894][ T8725] ? shmem_mapping+0xd/0x50 [ 286.869921][ T8725] ? __pfx_delete_from_page_cache_batch+0x10/0x10 [ 286.869952][ T8725] ? __filemap_fdatawait_range+0x1d2/0x230 [ 286.869973][ T8725] ? __pfx_workingset_update_node+0x10/0x10 [ 286.869998][ T8725] ? folio_mapping+0x16f/0x240 [ 286.870029][ T8725] ? truncate_cleanup_folio+0x34a/0x430 [ 286.870067][ T8725] truncate_inode_pages_range+0x28a/0xda0 [ 286.870121][ T8725] ? __pfx_truncate_inode_pages_range+0x10/0x10 [ 286.870163][ T8725] ? smp_call_function_many_cond+0xbc5/0x12d0 [ 286.870197][ T8725] ? lockdep_hardirqs_on+0x9c/0x150 [ 286.870252][ T8725] ? __pfx_has_bh_in_lru+0x10/0x10 [ 286.870296][ T8725] blkdev_flush_mapping+0x108/0x270 [ 286.870330][ T8725] ? bdev_release+0x40f/0x650 [ 286.870360][ T8725] bdev_release+0x417/0x650 [ 286.870393][ T8725] ? __pfx_blkdev_release+0x10/0x10 [ 286.870412][ T8725] blkdev_release+0x15/0x20 [ 286.870430][ T8725] __fput+0x44c/0xa70 [ 286.870462][ T8725] task_work_run+0x1d1/0x260 [ 286.870490][ T8725] ? __pfx_task_work_run+0x10/0x10 [ 286.870520][ T8725] do_exit+0x6b5/0x22e0 [ 286.870547][ T8725] ? do_raw_spin_lock+0x121/0x290 [ 286.870572][ T8725] ? __pfx_do_exit+0x10/0x10 [ 286.870605][ T8725] do_group_exit+0x21c/0x2d0 [ 286.870628][ T8725] ? lockdep_hardirqs_on+0x9c/0x150 [ 286.870657][ T8725] get_signal+0x1286/0x1340 [ 286.870697][ T8725] arch_do_signal_or_restart+0x9a/0x750 [ 286.870728][ T8725] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 286.870763][ T8725] ? exit_to_user_mode_loop+0x40/0x110 [ 286.870794][ T8725] exit_to_user_mode_loop+0x75/0x110 [ 286.870823][ T8725] do_syscall_64+0x2bd/0x3b0 [ 286.870860][ T8725] ? lockdep_hardirqs_on+0x9c/0x150 [ 286.870889][ T8725] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.870910][ T8725] ? clear_bhb_loop+0x60/0xb0 [ 286.870933][ T8725] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.870954][ T8725] RIP: 0033:0x7f3c8f38e929 [ 286.870972][ T8725] Code: Unable to access opcode bytes at 0x7f3c8f38e8ff. [ 286.870982][ T8725] RSP: 002b:00007f3c902e00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 286.871005][ T8725] RAX: 0000000000000001 RBX: 00007f3c8f5b5fa8 RCX: 00007f3c8f38e929 [ 286.871020][ T8725] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f3c8f5b5fac [ 286.871052][ T8725] RBP: 00007f3c8f5b5fa0 R08: 7fffffffffffffff R09: 0000000000000000 [ 286.871066][ T8725] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f3c8f5b5fac [ 286.871081][ T8725] R13: 0000000000000000 R14: 00007f3c8f6df940 R15: 00007f3c8f6dfa28 [ 286.871102][ T8725] [ 287.565910][ T6378] usb 3-1: USB disconnect, device number 42